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Glossary 


DEDICATION 


To all the first responders out there (by title or by intent) who have 


experienced failures in the practice of your craft. Do not hide your failures 
behind a curtain of shame. Shine your light on them, look them in the eye, 
expose them, learn from them, and share them with the world so that others 


may gain value from you. 


HOW TO USE THIS BOOK 


This book presents several case studies of lock picking and other entries that 
have occurred in the field. It also provides several Tactical Lock Picking (TLP) 
guidelines that, during field applications, I’ve identified, organized, 
systematized, and sharpened into a curriculum of study. The curriculum is the 
product of 11-plus years of experience including active and reserve military, 
federal law enforcement, local law enforcement, private security, professional 
training and research, personal experience, and guidance handed down from 


family and friends. 


Tactical Lock Picking: The art of using limited resources to overcome locked 
obstacles during an emergency, when it is morally right to do so. 


¢ This book is not designed to teach you “how to pick a lock” (although 


you will find such information within these pages). 


This book is designed to teach you how, why, and when to apply this 
skill set in the field. 


It’s also designed to expand on and bring to life the guidelines within 


the curriculum I’ve created for this specialized course of study. 


This book also serves as a primer for students before they attend my 
Tactical Lock Picking course or as a refresher or resource after they 


attend. 


¢ This book is designed to help you minimize your failures in the field, 


and if you do fail, it is designed to help you overcome those failures 


and to learn from them. 


This book is designed to help you save time, save money, and save 


lives. 


Additionally, this book is designed so that you can read it in any order 


you choose and reference particular segments. 


Although the lens of this book shines its light mostly through overcoming 


locked obstacles during emergencies, the scope of readership (and perspective 


students for training courses) is astoundingly wide. 


If you live in any type of dwelling or you own or work at any type of 
business, this book will identify features of the locked infrastructure 
you may never have thought about. It will also offer many ideas on 


how to better secure your structures, vehicles, gates, etc. 


If you love solving puzzles or working with your hands or even 
performing magic, learning how some of these largely overlooked 
security mechanisms operate will really scratch your itch. It sure does 


mine. 


If you are planning to work or vacation overseas in a region that is 
more likely than Anytown USA to experience crime, this book will 


help you to prepare and to see the world of security differently. 


If you are a modern survivalist or a preparedness-minded individual, 
this book will help you tenfold, showing you how to secure your 
property, how to be more self-sufficient, how to save time, money and 
lives, and how to prepare yourself with the “keys to the city” during a 


large-scale emergency. 


¢ If you are a first responder (by title or by intent), you will probably get 
the most out of this book. The curriculum of the TLP course I teach 
really shines when time is short, resources are lacking, and the 


decisions you make have real-world consequences. 


Imagine going to a trade school to be a mechanic. They teach you how to 
change a battery, rotate the tires and fill them with air, and replace the brake 
pads. Imagine that’s all they teach you and you graduate having no idea how to 
even begin to diagnose a vehicle towed into the shop, unable to start. This 


hypothetical school would have missed the mark. 


Similarly, imagine taking a training course to be an emergency medical 
technician. You learn how to take blood pressure, start an IV line, and do 
CPR. But you never learn why or when to apply a particular emergency 
treatment or how to work through the steps of diagnosing a patient on scene. 


This hypothetical course would have failed to prepare you for the field. 


In the words of a mentor of mine, Jack Spirko, “There is a big difference 
between ‘potty trained’ and ‘potty educated.’ Would you rather your child be 
potty trained or potty educated?” 


I define potty trained here as the ability to apply your knowledge and 
perform a task after training has occurred. The child no longer wets his 
pants or pisses on the floor and can use the toilet without guidance or 


assistance. 


Potty educated could be defined as simply having been exposed to 
information. The child has been shown a list of all the different parts of 
the waste-redistribution-mechanism via a slide show presentation but 


may never have used a toilet, start to finish, by themselves. 


In the military, in law enforcement, and in most bureaucracies everywhere 


there is a mix of training and education and they don’t always occur together. 
The title “training” is applied incorrectly more often than not while the 
purpose of it is only to cover the ass of the providing agency, stating that they 
have informed their employees. This type of falsely titled “training” holds so 
many people back with red tape and bureaucratic bullshit. 


I’m Pat, and I’m here to change the way the tactical community provides 
training and insight. My mission is to fill this training gap where so many 
bureaucracies have failed, and to prepare people to effectively use many 


different skill sets in the field during real-life emergencies. 


You have my permission and encouragement to use excerpts of this book 


during training and education sessions as long as credit is given to the source. 


Disclaimer: Fair warning. I call my website and its associated platforms 
“uncensored” for a reason. This book contains adult language, adult concepts, 
adult humor, and adult references. Make sure you copy and paste this 


disclaimer in any complaint emails. :) 


CHAPTER 1 
CASE STUDY: BROKEN BUT 
NOT DYING 


SAVING LIVES AND PROPERTY 


A residential front door similar to the one in this case study. 


“Can any unit advise if they have a lock-pick set?” Dispatch called on the 


radio. 


“Three-William-Sixty-One, I’m available for that call,” I responded. I worked 
the West District. Dispatch explained that our East District was requesting a 
nondestructive entry to assist on a fire/medic call. In the local law enforcement 
agency I worked for, I was the only go-to “entry specialist” in our patrol 
division. I told them, “Clear it with Sergeant 150 please, and attach me. I'll be 


ol 
My sergeant responded on the radio, “This is Sergeant 150. Approved.” 


As I pulled up to the scene, I saw several squad cars parked on the street near 
the suburban residence with a fire truck and a paramedic truck right up front, 


in the driveway. I had to park about a football field away, behind all the other 
emergency vehicles. I grabbed my Second-Line Gear bag from my trunk 
and started the hike toward the front door. 


Pro Tip: The course | teach covers how to manage the use of your entry skill 
set, whatever your professional capacity. When appropriate, keep your 
supervision informed. That way, you’ll spread the liability. Soeaking bluntly, 
you are still responsible for your actions, but if your employers screw you, you 
can make it very clear that your supervision is responsible for approving those 
decisions. :) 


STEP 1 AND STEP 2: MORAL RIGHT FOR ENTRY 
(MRE) AND SPEED/LEVEL OF URGENCY 
(SPEED/LOU) 


I went straight to the front door and met with the patrol deputy, Deputy R, 
who was the Primary on scene (basically the same rank as every other officer 
but the one first on scene and responsible for directing personnel). “Hey! 
Youre here!” he said to me. “We've got an elderly woman inside. Lives alone 
with her dog. Slipped and fell. Immobile, probably a broken hip. She’s begging 
Fire not to smash her door in because she’s on a fixed income. We need you to 


get us in with as minimal destruction as possible.” 


I told him that because the home was a cookie-cutter one, there was a high 
probability of a quick and painless entry. With the information that a victim 
was locked in the structure who needed my help, MRE was achieved. But 
since a life was on the line, I sought out a medic to check the liability of my 


ever-changing Speed/LOU requirement. 


I tapped the shoulder of a nearby medic. “Based on your information, since 
this is a medical call and not a law enforcement one, do you need us to smash a 
window and crawl through against the patient’s request? Or do you feel 
comfortable letting me do a quick walkaround first (Target Assessment) 


and try to respect her request to not damage anything?” 


Pro Tip: Having taken the first steps in my on-scene management, | confirmed 
with the primary officer and the medics. If able, you should also involve the 
on-scene sergeant (supervisor). Again, the first two things you have to know 
before you start an entry are: (1) Do | have a moral right to make this entry? 
(2) How big of a rush do! have to be in? 


The medic and I discussed: 
1. The patient’s ability to clearly communicate to the 911 dispatcher 


2. The patient’s ability to talk loudly enough from inside her home to be 


heard by on-scene personnel outside her home 
3. The evident lack of loss of blood or consciousness 
4, Our ability at any time to breach a door or smash a window if need be 


The lead medic on scene gave me a verbal confirmation: “Yeah, go ahead. She’s 
broken, but not dying.” I could therefore take a few minutes to poke around 
and pick around before we had to decide whether to break a door or smash a 


window. 


I turned to Deputy R again: “You are in fact the Primary, right? Where is your 


supervisor, just so I can say I got a sergeant’s as well as medical approval?” 


Pro Tip: If your supervision’s response is wishy-washy, anything besides a clear 
“yes” or a “sure, go ahead,” don’t proceed. Or at least reassess your options. 


We called for the East Side sergeant, and he met us at the front door. “Hey, 
Sarge, I can almost certainly pick my way into this home. I just want to keep 
you in the loop and get clear verbal approval. Fire says they're not in a rush and 
they’re comfortable waiting until I do an assessment and try to make 


nondestructive entry.” He approved. I was specifically waiting to hear the word 


yes. 


STEP 3: ATTACK VECTOR IDENTIFICATION 


Now it was time to continue down the path of my decision-making process, 


that is, the Target Assessment and Entry phase. 


In about two seconds, I assessed the front door by identifying all the Attack 
Vectors available to me: 


1. No visible hinges on this side of the door because it was a push door 


(you turn the handle, in this case a thumb press, and push to open). 


2. A deadbolt and a passageway handle on the left. (I'd probably 
have to pick the deadbolt to get in. You can’t walk the deadbolt 
and there’s no reason to Shim the latch. More on this later.) 


3. A window on the right. (If the emergency took a turn for the worse 
and we had to get into the house in a rush, we could smash one small 
window, which would be easy to replace. And although we probably 
wouldnt’ be able to reach the deadbolt on the inside, I kept “reach 
tools” in my car that could help.) 


4, My ballpark guess was that it would take up to 10 minutes to rake 
open the front deadbolt. (At the time of this entry, I didn’t spend a ton 
of time practicing a more direct attack known as Single Pin Picking 
[SPP]. I mainly focused on quick raking techniques and several bypass 


options.) 


STEP 4: MANUAL UNLOCK CHECK (IF 
APPLICABLE) 


Step 1 and Step 2 are automatic in the field. You'll almost always have the 
chance to instantaneously confirm whether you have the right to enter a locked 
building and how quickly you need to get inside. While these two steps are 
mostly automatic, it’s still important to consider them to make sure you start 
on the right track. Step 3 is as simple as a quick glance to determine your entry 


points, or your Attack Vectors. 


Step 4 is often your first physical act on scene. If the obstacle is a doorknob, try 
the knob, take a deep breath, then try again harder. If it’s a window, try to slide 
the window open, take a deep breath, then try again harder. If it’s a padlock, 

push and pull the shackle to see if it pops open, take a deep breath, then check 


again. (This sequence will be repeated ad nauseam in this book, for a reason.) 


Looking at the front door to the residence, | identified the deadbolt as the 
obstacle to entry. I grabbed the handle and pressed down on the thumb 
activator and then gave the door a hard push and a pull. I took a deep breath 
and tried again, putting my shoulder into the door to make sure it was locked. 


It was locked. Step 4 complete for this entry point. 


Pro Tip: Another way to confirm that a deadbolt is activated (locked) on a 
push door (or even a pull door with a very tight door jamb) is to slide a 
flexible shim into the door jamb up high, run it down to the level of the 
deadbolt, and see if the shim makes contact with anything or if it can slide 
past. 


STEP 5: TOOL AVAILABILITY 


For a nondestructive entry with this set of obstacles I had to do a keyway 
attack, which meant I'd be able to start with tools in my Second-Line Gear 


bag, including some of the following as examples: 
¢ multiple lock-pick sets 
¢ bump keys 
¢ a pick gun (or snap gun) 


« comb tools (very low on my list of options because they can get stuck 


in the lock) 
¢ a boot to the door (if we have to switch to destructive entry) 


e a hammer to the window (for destructive entry) 


STEP 6: “NOW OR LATER" 


Knowing I had approval to take my time, I decided to walk around the house 
and look for an entry just screaming to me, “I’m easy! Choose me!” instead of 
burning time trying to pick a lock that could take (on a bad day) 10 minutes. 
I, therefore, chose to start the entry attempt “Later” for Step 6. 


Pro Tip: Economics plays a big part in Tactical Lock Picking (TLP), specifically 
the economics of time management. One of the basic skills you'll develop 
during your Target Assessment is knowing whether to start picking the first 
lock you see or to do a thorough inspection and determine the range of 
possibilities before starting. 


Prior to scouting out the next obstacle to assess, I figured ’'d make the most of 


having so many people on scene. 


STEP 7: OTHER RESOURCES 


A standard back door similar to the one in this case study. 


Since I had several pairs of hands, I figured I'd use them. “Hey, Primary, you 
know how to pick a lock? Ever tried it?” The primary officer on scene told me 
he owns a set of bump keys at home and understands the concept but that’s 
about it. “Great!” I reached into my bag and found a set of common bump 
keys and a bump hammer and handed them to him. “If you know the concept 
already, then use these. I’m going to check the perimeter of the house for 
another option for entry.” Second-Line Gear bag in hand, I started off around 


the house. 


Additional things to consider in your Other Resources step might include 
hidden keys or nearby passcodes, people on scene with skill sets who could 
assist you, a locksmith you could call while you work on other obstacles, a tool 
you could manufacture from your environment, a nearby friend or family 
member who might have a key to the building, and a search using your 
smartphone for knowledge about any of the specific locked obstacles and 
Attack Vectors you've identified. 


After assessing Other Resources, I continued my inspection of the house. 


We already had the MRE and the Speed/LoU identified for this target so we 
looped back into Attack Vector Identification (Step 3). 


I found a back door that had only one deadbolt and a passageway knob, or a 
simple knob (a knob that operates a latch but with no locking mechanism and 
no keyway on either side—a basic turn-to-open-and-that’s-it knob). The 
deadbolt was not visible, meaning I couldn't attempt to walk it, or jimmy it, to 
the side. The keyway, though, looked inexpensive, old, and worn. All things 


that worked in my favor. 


I got on the radio and told the deputy at the front door that I was attempting 
entry through the back door. (Insert your own adult joke here.) 


My very first lock-pick set. This is the same set I used on the case study. Costing between $35 and $55. “... the 
inventor called them Bogota rakes as they reminded him of the cool but threatening mountain ranges of his 
hometown on Colombia.” — Lockpickworld.com /products/dangerfield-bogota-lock-picks (2020) 


Again I attempted Step 4 (Manual Unlock Check): I tried the handle and 
pushed and pulled on the door, took a deep breath, and tried again harder. I 
confirmed the door was locked. (I’m going to reiterate this sequence so that it’s 
stuck inside your head for when youre stressed out and on scene somewhere. 
[ve gotten many professionals through locked obstacles by their simply trying 
the handle again... harder.) 


Now for Step 5 (Tool Availability) at this entry point: I knew I had the tools 
on hand to pick this lock. I therefore zoomed right to Step 6 (“Now or Later”) 


and switched phases from assessment to an entry attempt (“Now’). 


I took out a $35 toolset from my wallet (a.k.a. First-Line Gear). This set 
consisted of two pieces: (1) a Bogota rake with a bend in the back to use as a 
tension wrench and (2) a single hump (half diamond, single peak, etc.) also 


with a bend at the back that could be used as a tension wrench. 


I spent about two to three minutes on a “raking” type attack (randomly trying 
to get the pins inside the keyway to line up correctly). The sergeant walked 
around the house and asked me for a progress report. “I’m real close, Sarge,” I 


said. “Any second now and I think I’ve got it.” 


At this time in my life, I was able to overcome a lot of obstacles with the raking 
technique. I didn’t spend a ton of time practicing SPP, but based on a lot of 
experience I knew this lock was a great candidate for a raking attack. I was 


confident I needed just a little more time. 


The sergeant, rightfully, was getting impatient and keyed the mic on his radio, 
“If 3W61 [meaning me] can’t get this open in the next two minutes, I’m gonna 


call it and we'll just have Fire use their breach...“ 
Click. 


“Got it!” I yelled to the sergeant, who was then standing around the corner of 


the house from me. 


1. I set one tool as a tension wrench into the bottom of the keyway and 


applied light turning tension to the keyway. 


2. I inserted the Bogota rake (above the tool serving as a tension wrench) 
to start manipulating the pins inside the keyway while maintaining the 


light turning tension. 


—" 


. The plug unlocked and started to spin counterclockwise, but because 


of weathering and bad door fitment it became very tough to spin 


farther. 


2. I tried to use a pair of pliers to help, but the lock-picking tension 


wrench was not rigid enough and it became bent/damaged. 


3. I switched to a different, firmer tension wrench and with more force 


was able to get the plug to spin more. 


4. Now the deadbolt was fully unlocked. 


With one audible click, the plug started to rotate (the plug being the small 


cylinder into which you put a key). But because of the age of the lock, the 


weathering, and the latch fitment into the door, the keyway stopped spinning 
short of unlocking the deadbolt. Why? Because so many doors are installed 
and fitted improperly. At some point in your life, in order to lock or unlock a 
common deadbolt, you probably had to apply a little pushing or pulling force 
on the door. Sound familiar? That’s what was happening here. There was extra 
pressure on the deadbolt latch because of door fitment, and that pressure made 


it difficult to fully spin the keyway (see photo 1, above). 


From my Second-Line Gear bag I removed a pair of pliers. I used them to grab 
the semiflexible tension wrench really close to the lock and try to apply some 
extra force to the tool without bending it too badly. No luck. The amount of 


force needed damaged the tension wrench (see photo 2, above). 


Pro Tip: There are two main picking methods that most lock-pickers start with, 
SPP and raking. With SPP, you apply tension to the keyway and “feel” each pin 
individually and then lift it to its correct height. (Fun Fact: SPP is depicted in 
pretty great detail in some video games.) The raking method is most effective 
on low-security locks. Because of the mass production of locks and the 
inexpensive machining process and very loose tolerances in the product, you 
can exploit the lock’s design by applying light turning tension on the keyway 
and randomly raking / sweeping / jumbling (scientific terms!) the pins around 
until the lock opens. 


I went back into my Second-Line Gear bag for a less flexible, stiffer tension 
wrench. Because this wrench was a little more rigid and because it was set flat 
up against the lock face, I was able to use a lot more force to get the deadbolt 


to start to turn (see photo 3, above). 


With some metal-on-metal screeching, the obstacle unlocked (see photo 4, 


above)... 


And the door swung open. 


CONCLUSION 


The sweet old lady’s lap dog was quickly upon us, barking at our ankles. The 
medics were able to extract the patient out through the front door of the home 


with no damage to the homeowner’s property. 
g prop 


Lessons were learned, a new case study was recorded, and the curriculum 


honed (as should happen on every entry). 


LESSONS LEARNED 


¢ I bought a selection of stiffer tension wrenches to help overcome 


rusted and stubborn keyways. 


¢ I could have used any number of tools other than my semi-bendable 


Bogota rakes/wrenches to help me turn the keyway. 


¢ The photos in this chapter consist of re-creations of the case study. I 
now try to take photos (with permission) on scene in every case, both 


successful and unsuccessful, for use in my learning and my teaching. 


¢ I’m glad that I used a second pair of hands to try one technique while 
I attempted another, a smart decision for time management and 


overlapping resources, or function stacking. 


I’m also glad that I kept my command and my teammates in the loop 
and that I got permission for confirming my Speed/LoU with the 


medical staff. 


¢ Having a Second-Line Gear bag was a big help so that I didn’t have to 
go back to my trunk for each separate tool I would’ve ended up 


needing. 


CHAPTER 2 
WHAT TACTICAL LOCK 
PICKING IS AND ISN'T 


| Bluebeard Entrusting His Keys to His Wife a tiie Dore (. 1862) 


In modern psychology there’s a maxim that goes something like, “It’s very 
difficult to understand what normal behavior is. It is much easier to look at 
what is not normal and to go from there.” Because so many people ask me if 


I’m a locksmith, because a lot of people who research lock picking end up in 


hobby Locksport circles, and because lock picking has a special home in the 
hacker community and emergency entries have a special home among first 


responders, I’m going to talk about what this skill set svt and go from there. 


LOCKSMITHS 


Locksmiths will often have some combination of a brick and mortar storefront 
and a work vehicle to drive to job sites. Locksmith businesses commonly 
specialize in only a few areas of expertise like residential, ID card systems, 
vehicles, or commercial doors, etc., although some still are jacks-of-all-trades. 
Locksmiths are often required to be adept at the installation, repair, 
replacement, and upgrading of hardware—not to mention the logistics and 


administration of the business side of operations. 


The services that locksmiths provide are 100 percent at the convenience of the 
business. Yes, it is often in a company’s interest to be available for additional 
work, but the company has the absolute right to turn down and deny or 


postpone any type of service whenever they choose. 
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A view th the interior of a locksmiths van. (Photo courtesy of a locksmith friend of the author’ on Instagram: 
@hkygoli33) 
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Another view of the interior of a locksmith’ van. (Photo courtesy of @hkygoli33) 


While their projects may vary, locksmiths have the ability, in combination with 
their storefront, their vehicle, and a tool belt/bag, to store and transport lots of 


expensive, large, heavy, specialty, and duplicate items to a job site. 


Depending on their specialization, locksmiths might each own a few dozen 
different vehicle decoder tools (and backup duplicates) and associated manuals 
and training material, which would be relatively expensive. Or they might keep 
hundreds of key blanks in their vehicle along with a few different large and 
bulky key-cutting machines. 


A locksmith would also be expected to store all the tools and devices required 


to remove, fix, and install security hardware: drills, hammers, pry bars, arrays 


of different screwdrivers, boxes of nails and screws, and tapes and glues that 


could add up to a lot of weight and a lot of space, let alone cost. 


While it may be in the interest of locksmiths to complete some jobs in a hurry, 
they often have the luxury of time to select and organize the gear they need, to 
choose the time of day, to wait for weather to clear, to set up proper lighting, 

to retrieve different tools, to review manuals, videos, or resources, etc. through 


their own business lens and decision-making matrix. 


At times locksmiths do have to open or access a specific lock, and at other 
times they don’? have to access a specific entry point but are free to be creative. 
For example: If a piece of a key is lodged into a deadbolt keyway, the locksmith 
must address the problem with that deadbolt, but when a locksmith has to 
gain access to a residential home, they may be free to access any different 


number of locked obstacles. 


There are things that locksmiths don‘ specialize in, like some of the higher-end 
destructive entries. It’s probably a rare case for a locksmith to show up to 
someone's front door and say, “No problem, we'll have you in there in a jiffy,” 
and then to kick the damn door in. Probably not appropriate in almost any 


circumstance for an average locksmith call. 


LOCKSPORT 


A Locksport challenge setup. 


Just like there are competitive sports, competitive shooting, competitive butter 
sculpting, and competitive beard grooming, there is a growing global 
community of competitive lock picking known as Locksport. (For the record, I 
think obscure and unique things are often much cooler than mainstream 


things. Be weird!) 


It would be wrong to say Locksport is misunderstood because it is not yet 


widely known (though, as stated above, it is growing). It may be more fitting to 


say it has the capacity to be misunderstood. 


From what I know about the Locksport community, it mostly focuses on using 
picking tools and tension wrenches to open pin tumbler locks by manipulating 
the pins inside. Members also focus on a lock that is mounted into a vice, on a 
tabletop, in perfect lighting, and in air conditioning, with whatever specialized 


tools they choose and for which they can plan ahead. 


Some members participate in safe-cracking competitions or they attack higher- 


security pin tumbler locks or other locking mechanisms. But what I almost 


never see in Locksport competitions is lock bypassing. 


Locksport is the sport or recreation of defeating locking systems. Its 
enthusiasts learn a variety of skills including lock picking, lock bumping, and a 
variety of other skills traditionally known only to locksmiths and other 
security professionals. Locksport followers enjoy the challenge and 
excitement of learning to defeat all forms of locks, and often gather together 
in sport groups to share knowledge, exchange ideas, and participate in a 
variety of recreational activities and contests. — 
https://en.m.wikipedia.org/wiki/Locksport (2019) 


While bypass techniques are often known in the Locksport community, these 
techniques are rarely “competitive.” Sticking a bypass tool into a lock and 
twisting the lock open (bypassing the challenging keyway or security pins) 
wouldn't make for much of a competition. A bypass technique in Locksport 
competitions would be equivalent in chess to just flipping the board over 


instead of using strategy and planning to checkmate an opponent. 


Another area of misunderstanding about Locksport is legality. One of the most 
common questions I get from people unfamiliar with lock picking is, “Yeah, 


but isn’t that illegal?” 


The answer is, “Most likely, no. Probably not illegal.” Toool.us (and toool.org) 
has a very helpful running list of lock-picking laws by jurisdiction. (We will 
cover legal issues in the chapter “Guideline: Legal vs. Moral.”) Having spent 11 
years combined in federal law enforcement and as a local police officer, I can 
tell you that most (yes, most) police officers aren't familiar with lock-picking 


laws. Shocker. 


Locksport offers a mental and physical challenge, requires great skill and 
dedication, and is a lot of fun, not to mention addicting. For sure. Locksport is 
a great start to building your understanding of locks and to exercising your 


fine-motor skills, but Locksport alone will not turn you into a Tactical Lock 


Picker. 


HOBBYISTS 


ere 
=. 


= Spies fees cae ae 
set, and a TV show. 


A true hobbyist enjoying a $6 padlock, a pocket pick 


While many in the Locksport community may practice Locksport as a hobby, 


it wouldn't do to not mention the pure hobbyist. 


While there is definitely a broad spectrum of hobbyists (including the 
Locksport community), there are those who are content to sit on their couches 
with a $20 lock-pick set and the same old three to four cheap padlocks, just 
picking away while binge watching their favorite TV show. And this is totally 
fine! I support this. 


Others who fit this “hobbyist” category are those who enjoy puzzles or who 
have stumbled on lock entry techniques and have stayed curious, continue to 


test their skills, and are open to exploring and learning related skills. 


Mindset is what places people in this category—the mindset of approaching 
locked challenges casually, as occasional puzzles. If lock picking were an 


iceberg, hobbyists would be the ones that are okay with “just the tip”. 


RED TEAMS/PEN-TESTERS/OTHER SECURITY 
ASSESSMENT PROFESSIONALS 


While there is a debate in the security industry about the difference between a 
Red Team and a pen-testing firm or other designation (note the boldface type 
in the direct quote below), we're going to use a definition from a Red Team 


podcast—the Red Team podcast. 


A real Red Team is a group of highly skilled professionals that mimic 
and simulate a real adversary. This team will research, investigate, learn, 
and become the adversaries they are trying to portrait. They will also 
research the organization or thing they are trying to red team, 
understanding its culture, the industry, or area they are located at and 


what makes them run. 


By consciously working to assume the adversary’s role, a “thinking 
enemy,” a Red Team can provide a realistic view of how a new idea, 
plan, or approach can perform in the real world, helping leaders to 
understand and address the risks in every aspect of the business, and 
providing unorthodox views on problems and their solutions. — 


https://redteams.net/about (2019) 


A selection of security access features that are common ground for security-testing firms. 


Very generally speaking, security assessment professionals spend much less time 
with lock picking than with other security assessment tasks such as accessing 
computer networks, taking advantage of stairwells and elevator access systems, 
cloning ID key cards, drafting (sneaking) in through doors behind employees, 
digging through trash, and even using disguises and props like clipboards and 
nametags to gain entry into places. These security assessment professionals also 
spend quite a bit of time in administrative and logistical roles with marketing, 
attending meetings and briefings, and performing other bureaucratic 


functions. 


Lock picking does have its role in this industry, but you'll have a hard time 


getting hired as a “pen-tester” if you don’t know how to turn on a modem or a 


router. 


TACTICAL BREACHERS/POLICE, FIRE, EMS, ETC. 


There are definitely individuals in law enforcement, firefighting, and 
emergency services who know how to pick a simple padlock, but the topic is 
rarely taught in agency-specific curriculums. I’ve attended some very expensive 
and very high-end training, government and private, that taught tactical 
breaching, and at most, lock picking was a single bullet point on a single slide. 


There are exceptions, but the content found in this book is little-known in most 


military and law enforcement communities. 


A selection of battering rams and other tools common to law enforcement tactical-breaching operations. 


A snapshot sent from a student of mine, active in law enforcement, who needed a crash course over the phone on 


destructive entry. 


Tactical breachers often have many core tools that are very big and bulky and 
are used in very specific scenarios and that require specialized knowledge and 
training. Notice I said “knowledge and training” are required. While in some 
cases if you hit a door hard enough with a sledge hammer, you may get it to 
open, there are many more cases where if you have the perfect tool and the 
perfect setup but are untrained you may completely fuck yourself out of an 
entry. Examples of these situations (perfect tool, perfect setup, untrained 


operator) could easily fill a book. 


Here is a brief example (and a common one): Drunk man comes home and is 


locked out of his house; he watches a lot of TV and assumes you can easily 


kick in any door with no training; he takes a step back from his front door, 
leans toward it with a shufHle-step start, kicks the doorknob hard, twists his 
ankle, and the door doesn’t budge. (For the record, no, we do not kick 


doorknobs to get doors to open.) 


Tactical breachers often have entry authority before they even set foot on a 
property, and they often (but not always) have an increased Level of Urgency 
to make entry, regardless of the consequences of property destruction. This is 
especially true for Fire Fighters for their responses to scenes of visible fires 
taking place. Destruction of an entire door is much preferred to the burning 
down of an entire building. Some people in the Fire community teach less 
destructive methods of entry (like the great folks over at 
CoastalFireTraining.com that I interviewed in episode 131 of my podcast) but 
most of their techniques place human life and fire control way above any 


destruction of property due to their entry methods. 


Because of the situations that professional first responders routinely face, they 
are uniquely responsible to be familiar with wildly destructive entry methods 


(cutting human-size holes through walls, etc.). 


WHAT TACTICAL LOCK PICKING IS 
Tactical Lock Picking is the art of using lock picking and other entry and 
escape methods to gain access through locked obstacles, with limited 
resources, during emergencies, when it is morally right to do so. — 
UncensoredTactical.com (2019) 


One of the biggest goals of TLP, and the structuring of it, is for practitioners to 
benefit from the least amount of time spent training, the least amount of 


money spent on tools, and the least amount of tools purchased and carried 


into the field while overcoming the largest number of common locked 


obstacles. 


While this skill set can add value to anybody, it was specifically created for 
professional first responders and preparedness-minded civilians. The TLP 
curriculum was designed, tested, and shaped through the years so that in an 


emergency, people will have the knowledge, tools, and skills to be able to get 


into, out of, and through the most common openable locks. 


A few factors make TLP unique when compared with other specialties that 


involve lock picking and security: 


KEY FACTOR 1: THE FRAMING 


Built into my curriculum are two steps prior to attempting any entry, which 
obligate you to determine (1) whether you have the moral right to make entry 
and (2) how much of a hurry you are in. Written into the curriculum, as well 
as taught and reinforced during case studies presented in the classroom, is the 
principle that students make a habit of determining whether what they're 
doing is morally right. 


Also part of the framing of this skill set is that it is to be used in emergencies to 
overcome obstacles. Emergencies can range from being late to work to 
experiencing large-scale physical disasters. Because overcoming obstacles is our 
primary purpose, we don’t focus on repairs or replacements, we don’t specialize 
in installation of locks, and we don’t have to worry about how to properly 


rekey locks, etc. 


Additionally, the TLP curriculum is designed to be inclusive of creative 
options. While the curriculum is a great baseline to start with, feel free to 
absorb what is useful, discard what is not, and add your own flavor to it. I 
don’t limit students by saying, “We cannot use this technique” or “We cannot 
use this tool.” While TLP focuses on nondestructive entries, I couldn't care less 
if you kick open a door (when it is moral and reasonable) or if you use a sledge 


hammer to knock a hole in a wall. You can still call yourself a Tactical Lock 


Picker. 


KEY FACTOR 2: THE TOOLS 


When forming this curriculum, the following questions called for an answer: If 
youre in a hurry for an entry, wouldn’ it be better if you had the right tool 
with you instead of having to go get it or to wait for someone to bring it to 
you? Wouldn’ it help if you knew precisely which tools you had on hand and 
which were in the trunk of your car or in a nearby go-bag? Wouldn't it be 
better if your tools were stored in a way that was easy to organize and easy to 
carry? It might look cool to have a big plastic bin in your trunk stuffed with 
tools and lock-opening toys, but wouldn't you look a little silly during an 


emergency returning from your vehicle with an armful of random gear? 


Some tools are easily accessible to the general public and others are more 
specialized, more expensive, and sometimes highly regulated. Many tools are 
actually available in your environment. Many have multiple uses and others do 


not. 


I have considered all this to help determine which tools people should start 
with to serve as a baseline. I designed my Three Lines of Gear to organize 
how to select tools, store them, and even how and when to deploy them in the 
field. We will learn about these in the chapter “Guideline: Three Lines of 


Gear.” 


KEY FACTOR 3: TARGET ASSESSMENT 


Equipped with multiple tools and multiple techniques and confronting 
multiple entry points, it’s in our best interest to have an order of operations 
that makes logical sense and that functions as a constant reassessment between 


the most likely and the quickest methods of entry. 


Our Target Assessment phase helps entry specialists understand what 
they are doing, when they are doing it, and what they should have done before, 
during, and after. Target Assessment guides practitioners in how to make quick 


calculations on scene (or even before arriving on scene) in many different ways. 


In an emergency, one of the foremost factors in accessing locked obstacles is 
time. If someone is dying on the other side of a door and you wait too long to 
open that door to provide help, they'll likely die. Our Target Assessment phase 
helps you decide how much to assess initially, when to start your first entry 
technique, how to multitask and utilize additional resources, and how to 
determine the length of time you'll try a specific technique before reassessing 


and considering other options. 


KEY FACTOR 4: OTHER RESOURCES 


An issue vital to first responders and civilians prepared for emergencies is 
identifying and utilizing additional resources. Resources I’ve utilized in 
emergencies include tools delivered to me, maintenance personnel or family 
members contacted for spare keys, people on scene to assist, and a locksmith or 


even the fire department called on to help gain access. 


I’ve noticed that sometimes first responders will use a tool until failure and 


then move on to a different approach until failure and only afterward call for a 


keyholder. Big mistake. 


When a life is on the line, a much better use of time is to get all the resources 
you might need to start making their way to the scene. If you gain access 
before they arrive, you can always cancel them. In other words: “I’m going to 
start picking this lock. Go ahead and start calling known family members and 
tell them to drive here with a key, now. And have any unit with a hoolie tool 


drive here now too.” 


KEY FACTOR 5: THE HUMAN FACTOR 


In my curriculum, I also include a training block on social engineering. ..sort 


of. 


In the book Social Engineering: The Art of Human Hacking, author Chris 
Hadnagy defines his version of social engineering as “the art, or better yet, 
science, of skillfully maneuvering human beings to take action in some aspect 


of their lives.” 


In my skill set, we don’t maneuver other human beings into taking action, but 
we do try to understand how people commonly interact with their physical- 
security environment, for example, leaving a door unlocked or faux-locked, 
storing hidden keys, choosing shockingly simple four-digit codes, installing a 
push button lock but never changing the manufacturer’s default code, using 


the same code for every door in a facility, etc. 


We don’t maneuver other human beings into taking action; we maneuver 
ourselves into detecting and decoding how they may have interacted with their 
physical environment and we use those insights to help us get through locked 


obstacles. That is our version of social engineering. 


KEY FACTOR 6: FAILURES 


Imagine a lock picker gets called to help unlock a front door in an emergency. 
He brings all his hook and rake picks to attack the front door’s keyway. He 
waves off any attempt at calling for additional resources and says, “Don’t worry, 


”» 


I'll be able to get this keyway unlocked right away!” After 60 seconds of trying 
he starts to get nervous. Then come the excuses: “This keyway is a little rusty, 
and it’s a little cold out, and they must have installed the lock wrong.” Then 
after about three minutes he overcompensates and uses way too much pressure 
because he’s embarrassed, causing his fine motor skills to falter. Now he has a 
decision to make: how long does he continue trying and failing and how long 


before he tucks his tail between his legs and calls for additional resources? 
I don’t want you to be that guy or gal. 


Failures are not to be shrugged off and forgotten about but to be analyzed, 
welcomed, and learned from. Being aware of the vulnerabilities of handcuffs, 
the limitations of lock picks, the inability to see inside a lock, and the presence 
of unseen hardware will help you determine which tools to use, which entry 


points to choose, and what to do next if none of them succeeds. 


The TLP curriculum is based not only on what has worked in the field but also 


on what has not worked and why, and how to avoid such failures. 


I hope that during your training you struggle and you fail often. I also hope 
that when failure happens, you open your mind, you admit your failure, and 
allow yourself and others to learn from it so that you can take this skill set to 


new heights. 


CONCLUSION 


Unlike locksmiths: Tactical Lock Pickers cannot always wear specialized 
toolbelts, carry bulging tool bags, and store expensive and specialized heavy 
equipment in our vehicles. We don’t have storefronts with racks of products at 
our disposal. Also, we must be able to act in emergencies and cannot always 
delay a project. We might need to make entry in the dark, the cold, or the rain. 
And we might have only one or just a few tools to choose from. However, 
because we are not locksmiths, in exigent circumstances we might be able to 
make certain types of destructive entry. Also, we don’t need to worry about 


installing, uninstalling, or repairing hardware. 


Unlike Locksport: Our locks won't be mounted in a vice on a table. We might 
have to reach through a gate, in the dark, to access a keyway facing downward, 
without being able to see the lock. (True story.) And unlike Locksport, a huge 
portion of our entry (and escape) techniques are based on shortcuts, hacks, and 
bypasses. We're interested only in efficiency and speed, and all techniques are 
available to us. While TLP starts with a core curriculum, it is not an exclusive 
set of skills. Students are encouraged to absorb what is useful for their personal 


version of the skill set and discard what is not. 


Unlike hobbyists: As a student of mine has said, “The field is not your couch” 


and “A sub-one-minute opening at home is often a 10-minute opening in the 
field with the same lock.” 


Unlike security assessment professionals: We are not in the business of hacking 
into network security or forging employee ID cards. But like security 
assessment professionals, we are in the business of researching patterns of 


human behavior and the workings of physical security. 


Unlike tactical breachers: When a professional operating as a Fire Fighter or 
under the team member title “tactical breacher” gets called to a scene, they 
often already know their MRE and Speed/LoU to be “Legally/morally 
authorized; go right now.” In TLP we frequently must figure out our 
Speed/LoU on the fly and determine on scene whether we can legally or 
morally make entry, and we must constantly reassess. Also, we don’t always 
have backup or others who can help us manage obstacles. We definitely don’t 
always have the authority to perform wildly destructive entries—we don’t 
routinely deploy with an axe in one hand and a Halligan bar in the other. 
When necessary, we do use basic mechanical breaching tools like sledge 


hammers, pry bars, or professional glass punches. 


There are plenty of places both online and in person where you can learn lock 
picking, but even some who teach (eye roll) super-duper cool “Law 
Enforcement and Military Only” courses don’t truly teach the freld application 
of this skill set. As of the writing of this book, I’m not aware of any other 
training where Target Assessment methodology, social engineering, lines of 
gear, failures, keypad codes, and specific use of additional resources are taught 
—at least not on the scale or depth that I share my passion. Some sources 
teach some of these things, but I am still shocked every time I teach a block of 
instruction and say to myself, “I can’t believe I’ve never seen someone else 


include this block before.” Or maybe I’m not shocked (#BureaucracyMindset). 


Noticing a lack of available training in the real-life application of all facets of 


this skill set, I saw a hole and was determined to shove myself into it. 


CHAPTER 3 
CASE STUDY 


RESCUING MAN AND MAN'S BEST 
FRIEND 


The door in this case study. 


“On top of everything else there’s a blizzard rolling in, and I can’t make it to 


the funeral home because the roads are so bad.” The person on the line, a 


teammate of mine on a Counter-Narcotics team, had just lost his father. He'd 
grabbed a toothbrush and put an extra pair of underwear in his pocket, booked 
a plane ticket on his phone while he drove to the airport, and called me after 
he landed in northern New Hampshire. Meanwhile, where our office was, it 
was the standard one million degrees Fahrenheit in South Florida, according to 
my internal temperature gauge. (I could tell it was one million degrees because 
as soon as I got into the driver’s seat of my car I was sitting in sweaty-ball 


soup.) 


“If there’s any way you could get into my house and pack me a bag with three 
days’ worth of toiletries and warm clothes and overnight it to me, that would 
be a life saver. And, dude, I know I’m asking a lot of you, but please can you 
check on my dogs a few times a day and let them out to go to the bathroom? 
I’m so sorry for the short notice.” Of course, [ would. Within a heartbeat I was 


on my way to help out my friend. 
We also had a brief discussion about his house being locked. 


My friend and I lived about 15 minutes apart. He told me his Team Leader 
(TL) had an extra key to his house. The TL lived more than an hour from us. 
My friend also said he locked only the bottom lock, not the deadbolt, and 
probably all the windows in the house were shut and locked. Living close by 
and having my skill set and all my tools, I figured I’d risk the 15-minute drive 
for the likely chance I could get in rather than undertake the two-hour-plus 
round trip to get a key from a third party. 


Lesson: There are a few ways you can start your Target Assessment before you 
arrive on scene and before you even leave your couch! One option is the 
internet, another is a person on scene who can call or send photos or even 
video chat with you, and still another is someone not on scene but in contact 
with you, who is familiar with the target. Be creative and gather as much 
information as you can as early as you can, and always remember to reassess 
throughout the process. 


You may not have noticed but I had already completed the first two steps 


required for every entry: 


¢ Step 1: I was given explicit permission from the owner of the house. 


MRE was met. 


¢ Step 2: All I had to do was attend to a couple of puppies and pack a 
bag to send to my friend. Speed/LoU was almost nil. 


If it did take me a few minutes on scene to realize I couldn't make a 
successful entry, I would have to drive two-plus hours to retrieve a key. 
The dogs would be fine and I could still feed and walk them and 


overnight a package to my friend within a few hours. 


¢ Step 3: Attack Vector Identification. I drove to the house, and when I 
walked up to the front door the first thing I noticed was there were 
hinges along the left side of the door (see photo, above). That told me 
it was a pull door and I probably could pop out the hinges unless they 
were security hinges, which was unlikely. Then half a second later, I 
saw the door jamb along the right side of the door (see photo, above). 
Even from a distance I could see part of a latch within that door jamb. 


After walking up to the door I was able to see a huge, gaping...gap. 


I'd already determined the deadbolt wasn’t locked because my friend 


told me it wasn't his protocol and also because I could see into the gap 
in the doorframe. I could have, right then and there, started to rake 
open the bottom knob’s keyway. I knew based on experience that with 
a simple raking technique such a doorknob could take me on average 


from 10 seconds to 2 minutes, depending on a few variables. 


The very wide gap between the doorframe and the door showed me 
that the dead bolt had receded into the opened/unlocked position and 
that the lower latch was beautifully set up for a latch-slip technique. 
Slipping the latch would allow me to bypass the keyway entirely. Most 
bypasses are faster than picking, which is a great reminder that if you 


have the chance you should start with bypass techniques. If they’re not 


available or they fail, then go to picking or other options. 


Sometimes all it takes is a quick glance to do your Target Assessment and start locating Attack Vectors. (1) 
Hinges are often taught to be the first thing you look for when determining which direction the door opens, in 
or out. (2) The width of the gap between the door and the frame may take a little more up close inspection to 
determine if your tools will fit and if the latches are susceptible to your known attacks like latch slipping and 

deadbolt walking. 


The tool shown here was not used in this entry, simply because I solved the problem before needing it. Im 


showing the photo to demonstrate just how wide “dat-gap” was. 


LESSON: INTRODUCTION TO “RAKING” AND TO 
“BYPASSING” A LOCK 


The Tactical Lock Picking curriculum starts with a 60-second crash course on 
how to perform a raking technique on a standard pin-tumbler door lock. 
(Most residential homes’ front doors in the US have pin tumbler locks.) 
Within a few minutes of the course starting, almost 100 percent of my 
students achieve their first successful entry. Here’s how it works: You insert a 
flat tool, a tension wrench, and apply tension to spin the keyway. Then you 
insert a squiggly-shaped pick called a rake and you move the rake in and out 
and up and down in a “raking” motion (photos 1-4). With these two tools 
(one holding tension and one raking) most low- and medium-security locks 


will eventually open. 


Bypasses are techniques where you go around the keyway of a door to attack a 


different part of the locking mechanism. Bypasses include sliding a flexible 
shim tool into a door jamb to push on the door latch (see photo 1, above); 
using a thin piece of metal to slip inside a padlock and push a lever into an 
unlocked position (photo 2); using a metal L-shaped rod to slip between the 
cracks of a double door and push on the inside push bar (crash bar) from the 
outside of the door (photo 3); and using a metal rod to manipulate the handle 
on the far side of the gate (photo 4). 


e Step 4: Manual Unlock Check. I tried the doorknob, took a deep 
breath, then tried again harder. The door stayed locked. 


Some older homes or weathered and high-use doorknobs will have 


quite a bit of jiggle to them, so I reminded myself to take a breath and 
try the knob in both directions using some elbow grease. Sometimes 
doorknobs are unlocked but don’t feel like it because they jiggle a lot, 
or they have a lot of “play” in them, or they’re a little “sticky.” I tried 
the knob twice. 


Again: Manually try the doorknob or door handle. Take a breath. Try 


again harder. 


Pro Tip: In real-world field application you will encounter lots of things that 
most lock-picking schools don’t prepare you for. (For example, in the photo 
above, you might notice that the deadbolt is installed upside down.) My aim 
is to provide as much real-life information to my students as possible. Right 
away | get my students used to picking upside down, with opposite hands, 
reaching without looking, etc., to prepare them for unique field scenarios. 


This portion of my Target Assessment on scene didn’t last very long, all of 


about three seconds. 


The first physical act in any entry attempt is to check and see if the obstacle is actually unlocked and then to 


double-check using some elbow grease: “Check, breathe, then check again harder.” 


I had two pocket-size, latch-slip tools (a.k.a. jim tools) in my wallet. I also 
had plenty of time to walk 20 feet to my car for my Second-Line Gear bag, 
which would give me access to a larger jim tool and make a latch slip a little 


easier. It ended up there was no need for that. 


Turning from the front door to return to my car, I noticed a clothesline 


within arm’s length of the door. On the clothesline I saw a wire coat hanger. 


It took me two steps to reach the clothesline for the coat hanger and two 


steps to return to the front door, where I achieved a successful entry. 


A training door with a wide gap in the door jamb. The gap makes it easy to fit tools between the door and the 


doorframe, which in turn makes it easy to manipulate the door latch. 


A wire coat hanger hooked around the door latch. 


A successful latch-slip entry. With trial and error and basic motor skills, many low-security doors, and even 


some high-security doors, can be accessed using this method. 


The directions for this entry would have been: “Slip the coat hanger loop 
behind the latch, and pull and wiggle the coat hanger while you lightly pull 
open the door.” Or as simple as: “Pull and wiggle.” And some are upset that 


I teach these techniques to people other than cops. Gasp! 
To summarize the last 10 seconds of this case study: 

¢ Performed visual inspection. 

¢ Noticed wide-open gap in doorframe. 


¢ Confirmed deadbolt unlocked. 


¢ Determined latch primed for bypassing. 

¢ Tried the handle, breathed deeply, tried again. Confirmed locked. 
¢ Decided to retrieve large jim tool. 

¢ Spotted coat hanger. 

¢ Concluded, based on experience, no need to look further. 

¢ Completed assessment phase. 

e Attempted latch bypass. 

¢ Achieved entry. 


With my high-tech coat hanger entry complete, I went inside the house 
and was greeted by two huge puppies who were happy to see me. I was able 
to attend to them for the week and to overnight a personalized care package 
(including a gift of a hidden flask in a fake Bible) to my friend who was 


dealing with a funeral and a personal loss. 


Based on my experience, I figured there was a good chance of easily 
attacking this latch before conducting a walkaround of the property. But 
faced with larger properties/facilities or with a higher Speed/LoU 
requirement, you might have to ask yourself, “Is it worth starting now even 
if it might take up to 10 minutes of picking, or should I first look for an 
option taking up to 10 seconds?” This calculation can vary from entry to 
entry and can even change multiple times during a Target Assessment and 


your entry attempt. 


I teach using a two-pronged approach: One prong is the artform, and one 


prong is the science behind physical security and its vulnerabilities. Add 


experience and you will be able to develop your own odds of success and 


projected timelines. 


A hidden flask inside a fake Bible. 


I don’t have every answer; I don't have every tool. A big part of how we as 
tacticians make decisions on scene should be to play the percentage game. 
Calculating timelines and the likelihood of success can help get us into and out 


of locked obstacles as safely and efficiently as possible. 


Fun Fact: Most of us don’t enter the military with a crippling alcohol 
dependency, but once we’re in we sure do know how to use what’s available 
to us to help us adapt, overcome, and cope. 


LESSONS LEARNED 


Target Assessments can happen before you arrive on scene; they can 


even happen before you get off your couch. 


MRE and Speed/LoU, too, can sometimes be determined before you 
get off your couch. 


By now you should start seeing that knowing how long it takes to use 
specific tools on specific locks has a huge impact on how you perform 
your Target Assessment, especially in the “Now or Later” phase of 
determining whether to start your entry attempt, retrieve a tool, or 


look for another Attack Vector. 
Tools can be found in your environment. 
Sometimes very cheap tools can be just as effective as expensive ones. 


Consider reasonableness: Other than in an emergency with no other 
alternatives, would it be reasonable to gain entry by smashing a 
window? No. Would it be reasonable to kick a door in to pack a 


friend’s overnight bag? No. 


A lack of knowledge could cost someone a couple of hours waiting for 


a locksmith and a $100-plus bill, all for about 10 seconds of work. 


Because of a lack of knowledge, very often people stuck outside a 
locked obstacle just give up. 
¢ One of the things I am most proud of is the ability to impart 
to my students and to you, the reader, the awareness that 


being stuck outside a locked obstacle isn’t necessarily the end. 


Use that big, sexy brain of yours, and also teach your loved 


ones these unique survival techniques. 


CHAPTER 4 
GUIDELINE: THREE LINES OF 
GEAR 


THE WHAT, HOW AND WHY OF GEAR 


Before we go any farther in this book, we should take a look at which tools I 
routinely carry in the field, how I chose which tools to purchase, how | 
organize and store them, and how I deploy them in the field. There are 
segments of this book that could alone justify the book’s price. This is one of 


them. 


A firefighter wouldn't be effective if they had to carry their air tank in one hand 
and axe in another while trying to operate a water hose. Paramedics wouldn't 
be effective if on the scene of a vehicle crash they had to keep returning to their 
vehicle for every little medical tool. Most professionals who apply their skills in 
the field often carry specific tools in specific ways to make their job more 
efficient and effective. Your tools should be purchased for a reason, stored and 
organized with a purpose, and deployed in the field in a way that makes your 


entries more effective, not less. 


Because of the amount of overlap in this book, chances are that you already 
have an idea of the tools Tactical Lock Pickers carry. Now let’s dig deep into 


more of the why as well as the what. 


FIRS T-LINE GEAR 


My First-Line Gear: wallet and key ring. 


First-Line Gear is defined as “the tools you routinely carry on your person.” 
This most commonly means your wallet and your key ring. It can also include 


your belt. First-Line Gear does not include backpacks, satchels, purses, etc. 


A variable piece of First-Line Gear might be outer-body armor or a gun belt. 


(We'll cover this more in “Second-Line Gear.”) 


The reason we think of our gear in terms of First Line or Second Line is that at 


any given time we will know exactly which tools we have at our immediate 


disposal and exactly which tools are in our gear bag if we have to grab it. 


FIRST-LINE GEAR LAYOUT 


— 


. Sparrows Mace pick set. Around $12 from 
SparrowsLockPicks.com. This is a great Everyday Carry (EDC) set 


because of its small size, versatility, and price. It comes with a triple- 
peak rake (the back, which can be used as a tension wrench, has small 
“teeth” grooves for bottom or top of keyway tension), a hook pick 
(also with a tension option on the back), and several different tension 


wrench sizes and setups. I carry the hook and the rake and the thickest 


tension wrench in the set, all taped to one of the few plastic cards in 


my wallet. 


(Pro Tip: | have tried clear tape and duct tape but 
currently use electrical tape. Clear tape loses its 
stickiness pretty quickly, tears easily, and is not great 
for multiple lifts and re-sticks. Duct tape is way too 
much overkill and adds thickness to your card, which is 
a problem in minimalist wallets. Also, duct tape leaves 
a sticky residue on the tools and on your card. 
Electrical tape is durable and easy to remove tools 
from, and it doesn’t add a lot of bulk. Also, you can 
sometimes wiggle your tools back into electrical tape 
without having to lift it off. My taping method is shown 
in the photo, below.) 


2. Bogota Pi pick set. Approximately $40—-$50 from different 
vendors; I usually get mine from SEREpick.com. Each tool is 3.14 
inches long. (It’s a math joke, I like it.) A benefit of the Bogota Pi 
picks is the smoother feel to the Pi tools’ finish. If you have a bent 
tension wrench from the Mace pick set and the curved tension wrench 
from this set, you can hit all four cardinal directions of tension 
wrenching (north, south, east, west; or 12 o’clock, 3 o'clock, 6 o'clock, 
and 9 o'clock) with your First-Line Gear. The rake from the Mace 
picks is a little too tall and lifts the pins a tad too high for a few of the 
locks I practice with; the double and triple Bogota rakes in the Pi set 
are a little less tall and a little smoother and can therefore open the 
locks that Mace picks sometimes can’t. The set includes a credit-card- 


size pocket where I keep my Sparrows Hall Pass. 


(Pro Tip: | do not recommend credit card pick sets that “punch out” 
of their frames because you can’t get them back in again.) 


3. Sparrows Hall Pass. This door latch jim tool, from Sparrows at 
about $8, is good in a pinch. I have successfully used it in the field 
hundreds of times. It helps you manipulate simple latches from the 


pull side of a door. 


4, OscarDelta Luggage Tag. I get mine from OscarDelta.co.uk for 
around $5. It consists of two plastic cards with a swivel joint, used for 
slipping latches from the push side of a door (a.k.a. a door latch shim 
tool). The cards, attached together, slide around between the door and 
the doorframe to push the latch, causing it to recede into the open 
position. This tool is not 100 percent effective because the cards are a 
little thick, but it does have some applicability. Our First-Line Gear is 
not about opening 100 percent of locked obstacles but about giving 
you a percentage of a chance over a large range of different types of 
obstacles. I recommend you make an angled cutout in this Luggage 
Tag so it can also be used as a jim tool from the pull side of the door. 


The tool I own, seen here, has several hundred successful uses. 


5. Hair snap clip. A.k.a. barrette. Less than $1. Make sure you have 
the right size and the right finish. This tool is inexpensive, so test it at 
home. It can be quickly modified to use as a padlock bypass, handcuff 


shim tool, flex-cuff shim tool, and more. 


6. Auto jiggler Rockout Keys from Sparrows. About $12. I 
recommend this set because it gives you three shapes you can use in a 
variety of wafer locks and because it is inexpensive. Like the Mace pick 


set, it’s easy to store on the back of a plastic card. If you carry a large 


keychain (I now keep my key set very small), you can save wallet space 


by carrying a few jigglers on it instead of in your wallet. 


7. EZ Decoder tools, sold in many places, I prefer mine from 
LockPickTools.com. About $10 for a two-pack. A huge majority of 
low- and medium-security locks with spinning dials (think of old- 
school briefcases with three-digit code wheels) can be decoded using 
these tiny metal strips. They can also be used to bypass some locks, 


going around the keyway or the code and manually unlocking the 
lock. 


8. Comb pick. Also from LockPickTools.com. Around $10. This tool 
basically acts as a master key for certain makes/models of padlocks. Of 
all of the padlocks on fences, gates, and lockers out there, probably 
close to 1 in 10 can be defeated by a comb pick. But like most items 
in my First-Line Gear, this tool adds almost no weight and takes up 
almost no space. When I see an applicable make/model lock in the 
field, I'll know I have a 99-plus percent chance of opening it as if I had 


a master key. Worth it, in my opinion. 


The reason I use this setup is that it gives me multiple options for raking tools, 
tension wrenches, and single-pin picks, as well as two latch-jim options, a 
latch-shim option, options to decode multi-wheeled combo locks, some 
padlock-bypass options, and a few restraint-escape options. All without adding 


almost any extra weight or space to my minimalist wallet. 


The Tactical Lock Picking curriculum is not about getting you through every 
obstacle. That is impossible. Good luck trying to hang every lock-opening tool 
known to man on your belt! TLP is about getting you through the highest 


percentage of reasonably openable locked obstacles. 
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I keep my loose tools from getting lost in my wallet by securing them with short strips of electrical tape. Some 
people recommend clear tape, though in my experience it rips too easily, is difficult to peel off, and quickly loses 
its stickiness. Others recommend duct tape, though I find it too thick and too difficult to peel off and it too often 
leaves a sticky film. I use electrical tape because its easy to peel off and reapply over and over again and it 
doesn't rip too easily. It will eventually leave a slight sticky film on your tools but only after a long period of 
repeated use. 


Especially with First-Line Gear, if I told you there was a tool that would get 
you through only up to 10 percent of makes/models of locks but added almost 
no cost, weight, or size to your gear setup, would you turn it down? One of the 
best options that fits this description is the auto-jiggler set I carry and also 
recommend. Not too long ago, the percentage of vehicles that used wafer locks 
was, for argument’s sake, in the high 90s. Every single day more and more 
vehicles are produced that do not use wafer locks. So what was originally a 90 


percent—plus possibility of a jiggler entry is diminishing. But even with that 


percentage declining over time, why would you not keep one or two tiny, 


inexpensive jigglers on your key ring? 


Again, my curriculum is not exclusive. If you are, say, a vehicle reposessor, you 
might put 10-20 different jigglers on your key ring, and I support that. Make 


your skill set and tool setup unique to you. 


SECOND-LINE GEAR 


My Second-Line Gear go-bag. 


Second-Line Gear is defined as “tools that are organized and carried in a small 
to medium go-bag.” Whether a shoulder bag like I use or a backpack, or even a 
fishing tackle box (though it is highly recommended that any option be hands- 
free), Second-Line Gear consists of tools that can be organized in a small 


container and carried to a scene. 


Organized is an important word to “key” in on here (pun intended). Because of 


the unique size, shape, and nature of the tools used to make entry using lock 


picking and bypass methods, if you were to put all your tools into a gallon-size 
food storage bag and then put that bag into a small backpack, you would be 
taking one step forward and one step back. Organizing your tools so you can 
retrieve them in low or no lighting is important. Saving time by knowing 


exactly where your desired tool is could save a life. 


Let’s talk body armor. If you routinely wear a gun belt and a load-bearing vest, 
or outer body armor, tools on that belt and in that vest would be considered 
your First-Line Gear because your belt and vest are semipermanently secured 
to your person (even though you can “wear” a backpack, it is not considered 
First-Line Gear). How would body armor become your Second-Line Gear? 
Answer: If you routinely kept it in the trunk of your vehicle and wore it only 


on rare occasions, when needed. 


Whatever's currently on your body (minus backpacks and bags) counts as First- 
Line Gear. Whatever's currently on the back seat or in the trunk of your 
vehicle or in a closet, even if it can be worn like a backpack, is your Second-Line 


Gear or Third-Line Gear. 


Because First-Line Gear is so limited (keychain, wallet, pockets, maybe a belt), 
I don’t talk much about your area of operations (AO), or the environment 
where youre working, for your First-Line Gear. However, if there are locks you 
commonly encounter in your AO or if you have a specific skill set to add to 
your personal TLP mix, your Second-Line Gear will likely be different from 
mine. For example, if you work in a tech-heavy environment and maybe deal 
with RFID key card readers a lot, it would make sense to add applicable tools 
like a small computer, extra blank RFID chips and cards, and RFID 
readers/writers. Or if you handle a specific type of vehicle or fleet of vehicles, it 
would be smart to get a decoder tool for that make/model. When I was in local 
law enforcement, our vehicles were mostly Ford Crown Vics and, big surprise, 


cops would lock themselves out all the damn time. A decoder tool was an 


addition to my gear that made sense for me then. Now I’m a civilian, that tool 
is at the bottom of a cardboard box at home and other items have taken its 


place in my go-bag. 


SECOND-LINE GEAR LAYOUT 


Here I list tools by the “pocket” of my go-bag where I store them, based 
sometimes on their purpose and sometimes based on their size and shape. The 
organizational grouping I use may not work for you if you have a different type 


of bag. Make the layout your own. Try. Fail. Learn from the failure, and adjust. 


FRONT SLIM POCKET 


Front Slim Pocket 


1. Small multitool with scissors, knife, screwdriver, file, etc., for 


multiple uses. 


2. Hands-free, headlamp-style flashlight with red-light option. 
Even if youre not using red light to avoid detection by an enemy, 
sometimes superbright white light is just too much when you need to 
see up close into a tiny keyway. I keep a headlamp in this pocket 
because on a dark entry the first thing I need is light and I don’t want 
to have to rummage through a spacious pocket with lots of tools in 


order to retrieve it. 


3. Stretchable bracelet with a Tungsten Carbide striker 


bead used as a lightweight tool to break glass. Available at 
OscarDelta.co.uk for about $15 each. This model is the GTFO Wrist 
Strap. 


FRONT TOP POCKET 


Front Top Pocket 


1. Tiny flathead and Phillips screwdrivers. The two main uses are for 
furniture bypasses (taking apart the installation of the lock by, for 
example, unscrewing the mounting points) and for picking the 
“privacy locks” of most residential doorknobs. Multiple sources and 


prices. 


2. Sparrows set of bump keys. I like Sparrows a lot. I recommend 
SparrowsLockPicks.com to people daily. And maybe they've updated 
this product, but I’ve found almost no success with it. I keep it in my 
go-bag to show students that sometimes less expensive, generic tools 


work just as well or better than flashy name brands. 


3. Generic set of bump keys. This works quite well. Multiple 


sources and prices. 


4, Generic expansion set of bump keys. Includes just a few 
additional options, though (believe it or not) you can buy sets of 15, 
20, 30, and more. I have this only as a last-resort option for an entry. 
Bumping is not as effective as you may have been led to believe on the 


internet. Multiple sources and prices. 


5. Hair snap clips. Snap clips, a.k.a. barrettes. These have multiple 
uses for restraint escapes and for lock bypasses. One is carried in my 
First-Line Gear. I carry duplicates in my Second-Line Gear bag 
because this tool must be broken in half to use in the field for certain 
obstacles and it’s good to have multiple ones of these because they 


have multiple uses and are disposable. Multiple sources and prices. 


6. Comb tools. Available at SparrowsLockPicks.com ($12) and 
LockPickTools.com ($8). I use these as my first option only if I know 
off the top of my head that a specific make/model of lock in the field 
will work with them. I carry one small comb that is specific to only a 
few types of locks in my First-Line Gear. I carry other options of 
different sizes in my Second-Line Gear to expand this type of 
tool/attack to cover other types of locks. 


(Pro Tip: Some tools are potentially nonretrievable. Combs are an 
example. They very easily become permanently stuck inside some 
locks.) 


7. Generic auto-jigglers. For use in wafer locks. These work great! 
When I carried a larger key chain in my First-Line Gear, I would put 


10. 


11. 


one or two of my favorite jiggler keys on it. Now I keep a set of 


Rockout Keys in my wallet. Multiple sources and prices. 


. Auto-jiggler Rockout Keys from Sparrows. About $12. The jigglers 


in this set are simple enough to use that I can give someone else on an 
entry a crash course and they can try one lock while I work on a 
different entry point. This is a duplicate item (with the Rockout Keys 
in my First-Line Gear) in part so I can hand a set to someone to help 


with an entry and in part because not all jiggler tools are created equal. 


. Coffin Keys from Sparrows. About $27. These are a set of auto- 


jigglers that Sparrows calls their “Coffin Keys” set. These cut into your 
fingers a bit after continued use, but they work well. The smaller 
jigglers are really great for smaller keyways; that’s where this set shines. 
The larger jigglers serve as duplicates for me. One problem I’ve had is 
with the chain coming apart in the field. An easy fix is to replace the 


chain, but I keep it to use as a teaching tool. 


Generic set of warded picks. $12. For warded locks. Sparrows 
has these for sale, but the generics also work fine since most warded 


locks are very low security. 


On loop: (Left to right) Handcuff key. Schlage privacy 
doorknob emergency key (a duplicate. Schlage privacy locks can 
often be opened by small screwdrivers which I also carry in my 
Second-Line Gear). A broken EZ Decoder, for teaching 
(demonstrating how delicate this tool is so it’s worth having duplicates 
in your First-Line Gear and Second-Line Gear). Quick Stick, a thick 
metal shank used for certain padlock bypasses (I hardly ever use it in 


the field). Kwikset privacy doorknob emergency key (a 


duplicate. Kwikset privacy locks can often be opened by small 


screwdrivers, which I also carry in my Second-Line Gear). 


FRONT BOTTOM POCKET 


Organization is the name of the game for our Three Lines of Gear. Being able to carry a selection of your gear to 


the scene is important. Being able to know definitively which tools you have on hand is important. Being able 
to remove your tools from your bag in the dark or without looking is important. This carabiner allows me to 
take all my ringed key sets out of my bag’s top “pocket” without having to rifle through a stack of them in the 
bag. It also allows me to hold them in front of my face for easy identification and to select one set at a time, 
which helps prevent tools from falling out of my bag or out of my hands, particularly when Im wearing gloves 
and diminishing my dexterity. 


Front Bottom Pocket 


1. Needle-nose pliers for bending custom tools on the spot or for 


use on a locked obstacle. Multiple sources and prices. 


2. Sparrows Mini Jim. Around $10. Not the best tool for its size 
since some latches require a little elbow grease to open with a jim tool, 
and this tool’s small grip makes it difficult to apply a lot of pressure. 
Still, it’s small and inexpensive enough to keep on hand to give to 


someone on scene if I have to work on other entries. 


3. Auto-tension wrench and double wafer rake. About $25. 
There are some vehicle-mounted wafer locks that I just fucking 


struggle with when I use auto-jigglers. Very often, Pll use an auto- 


tension wrench and a double wafer rake instead. These tools help get 
most of those tricky vehicle wafer locks to pop right open. If I have 
only my First-Line Gear I'll use the auto-jigglers in my wallet. 
Although this auto-tension wrench and double wafer rake are often 
better at achieving an entry than jigglers, they’re a bit of a hassle to 


carry. Pros and cons. 


. Jiggler and wafer rake expansion tools. $30. At the time of 
this writing, I do not keep any type of reach tool in my Second-Line 
Gear because of the length of such tools. Instead I include tons of 
different wafer lock tools to choose from to try a keyway entry on a 


vehicle. 


. Padlock bypass driver tools and wafer-breaker kit. $20—$60. 
This kit includes a bypass driver used to reach past the keyway to 
unlock the lock, as well as two small chisels used to break the security 
wafer (that may or may not be installed) so that the bypass driver can 
access the back of the lock. Within the lock-picking community, these 
bypass driver tools are widely considered hit or miss. Even brand new 
out of the box they may not work. But when they do work, they are as 
effective as a master key for several different makes/models of 
padlocks. The pros definitely outweigh the cons. My advice? Buy 
multiples from multiple manufacturers, not only because of 
manufacturing defects but also because of the tendency of these tools 
to break. Inside the same clear case I keep a Shank, or knife ($15), a 
duplicate of the Quick Stick to keep in my bag’s front top pocket. 
Here I also keep a Sparrows Ultra Decoder ($15), which I 
absolutely freaking love. It’s a decoding tool and a bypassing tool with 
a great textured grip, and it’s big enough so you can use your whole 
hand in your attack. Additionally, I keep two small silver-colored 


chisels, which are wafer breakers. Some locks have been upgraded with 


little wafers to prevent bypass tools from reaching where they need to 
inside a lock. Using these chisels you can punch a hole in the little 
wafers and reach farther back into the lock. Also included is a security 


wafer to help upgrade a lock in the field if necessary. 


6. Glass punch. If an infant or a pet is in danger of dying in a car, this 
tool might become a first option rather than a final one. Before 
deploying it, before even buying or carrying it, do yourself a favor and 
do some research. It can cause injury or death if used improperly due 
to the resulting broken glass. Also, a glass punch will not work on 
most front windshields. Spend a few minutes on the internet so that 
you don’t look like an idiot or even hurt yourself or someone else. 


Multiple sources and prices. 


7. Scarab Flex Cuff Cutter from ASP. $25. Used to cut zip ties and 


flex-cuffs. A great compact tool, it can be operated one-handed. 


(Pro Tip: DO NOT, unless it is a life-or-death circumstance, try to slice 
someone out of a pair of zip ties or flex-cuffs with a pocketknife. 
More on this later.) 


8. Large-handled decoder tool. Pack of three, $42. These are freaking 
awesome. Well worth their price, they have a huge ROI. They’re used 
on multiple types of locks as a bypass tool, decoder tool, or shim. 
Trust me, purchase multiples of these. I like the one from Sparrows a 
lot, but I have multiples from various manufacturers. (In a pinch, 
these tools, like several others, can be created from existing materials 


in the environment, even from trash.) 


9. A duplicate padlock bypass driver tool. $20. (Above in #5, there 


is a bypass driver and wafer breaker kit. This, #9, is a duplicate, an 
extra, of just the bypass driver.) 


MAIN POCKET 
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Main Pocket 
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This “pocket” has several bands for securing gear. Organization helps you look so much cooler than storing tools 
loosely in a box in the trunk of your car. It can help you explain to someone assisting you where exactly a tool 


can be found. It also may help you save a life. 


1. Seattle Rapid Access Tool, a.k.a. SEARAT, from 
IgnitionUSA.us. About $80. This very durably built bypass tool is 
mainly used for accessing latches but also has additional functions. 
The extra length and rugged design are a huge plus, taking this tool a 


step above some other latch jims in my gear. 


2. Bump hammer for the bump key sets in my kit. $30. Multiple 


sources. 


3. Sparrows Magneto. About $30. This magnetic bypass tool is specific 


to some makes/models of certain Kaba-brand locks. You just slap it on 
the side of the lock and the lock unlocks itself. I’ve tried this on several 
dozen Kaba locks in the field and to date have never gotten it to work. 
I have gifted this tool to friends and they have reported a few successes 
with it. Despite the low percentage of it working, when it does you 
can expect a huge ROJ; it can turn a two- to three-hour entry into a 
two- to three-second entry. So I keep it in my bag. I store it inside a 
foam and cardboard case to prevent it from getting stuck to other 


tools. 


4. Two small inflatable air bags. $20—$40. I use these for vehicle 
entries. They slip in between a vehicle door and the doorframe and 
expand, allowing a reach tool (think coat hanger) access to the interior 
of the vehicle to pull door handles or push unlock buttons, etc. 


Multiple sources. 


5. Two different pry tools. $25. These are used to help separate a 
vehicle door from the doorframe, which makes it easier to insert an air 


bag. Multiple sources. 


6. Standard Phillips screwdriver. Not necessarily a duplicate. I keep 
this mainly for teaching. Some locks require a screwdriver to take 
them apart so I can show students the lock’s internal parts and my 
small screwdrivers don’t work well for that task because of their size. 
Screwdrivers are also good at removing hardware in the field to assist 
with bypasses, consider a wooden pedestrian gate that is padlocked 
shut but the hardware that the padlock is hanging from has visible and 


accessible screws holding it to the fence. 


7. Long-handled latch jim tool. Sparrows has one with a very comfy 
handle for about $11. 


8. Generic small, handheld bolt cutters. Used for very small padlocks 


or certain types of wire, chain, etc. 


Pro Tip: All bolt cutters are not created equal. In my Tactical Lock 
Picking course, | teach an entire block of instruction on bolt cutters 
and their drawbacks. More on this in “Third-Line Gear.”) Multiple 
sources and prices. 


9. A Bang-It. This little orange construction tool is used to punch the 
retaining pins out of door hinges. It’s probably a good idea to keep a 
generic hammer on hand if you're going to carry this tool. Multiple 


sources and prices, usually less than $20. 


10. Tubular Lock Picks (7 pin and 8 pin). About $85 each. If you're 
just starting out, I’d recommend buying only the 7 pin since these 
tools are so expensive and the 7 pin is the most common type of 
tubular lock seen in the field. I wouldn’t call this a mandatory item 
unless you are a professional first responder or you have a specific need 


for it in your AO. 


ZIPPERED POUCH INSIDE MAIN POCKET 


I try to store tools in groupings based on the tools’ purpose, but sometimes I have to store them based on their size 


and shape. 


Zippered Pouch Inside Pocket 


1. Keyed Alike set. Multiple sources. Total cost to build your own or 
purchase a set can range from $50 to $100. These keys, when paired 
with the right make/model, make an entry instantaneous. For your 
personal Keyed Alike set you should definitely explore your AO and 
add and subtract keys where it makes sense. Fun Fact: Huge 
companies like car manufacturers, cabinet makers, and toolbox 
manufacturers don’t actually produce locks; they buy locks in bulk. 
Sometimes it makes sense for both seller and buyer to have tons of 
products that all use the same key. However, you probably don’t need a 
college degree to understand why this could make sense for companies 


but could also be a bad idea. 


. Full-handled hook picks. For more advanced SPP. These come 
individually and in sets and cost about $10 per pick. I recommend 
people start with the smaller First-Line Gear picks because you can 
carry them everywhere and get a lot of practice using them. I advise 
starting small with your toolset and growing out of your current tools 


before you purchase more advanced and specialized ones. 


. Credit card set. I’ve never used this in the field but, because I 
teach, some of my gear consists of examples to show my students what 
works, what doesn’t, and why. If you have one of these sets, great. If 
you don’t, I wouldn't spend the money. These come from a wide 


variety of sources and prices, usually less than $30. 


. Standard toolset. $20-$40. Includes picks with full-length 
handles, some hook picks, and some rakes. I keep a small decoder 


tool with this set so when I’m on scene, I can easily switch right to 


decoding if I come across a dialed lock. 


. EZ Decoder tools. Have I mentioned that these are hugely valuable? 
And also very delicate, hence, duplicates. I source mine from multiple 


sellers at around $10 for a pack of two decoders. 


. The Gut Wrench from Sparrows. About $8. A tool to take apart 
locks and put them back together. On the rare occasion your tools get 
stuck inside a lock, it helps to know how to take it apart so you can 


retrieve your tools and then return the lock to working order. 


. Standard Bogota set. About $30-$40. My very first lockpick set. 
This was the set I used in the case study “Broken but Not Dying.” One 


of the best starter sets out there. 


8. Flats from Bogota. Around $40. They store flat against the back of a 


credit card. 


9. Punch-out credit card set. I absolutely do not recommend this 
because once you punch the tools out of the credit card frame, they do 
not go back in. The Bogota Pi set in the First-Line Gear is a much 
better option because of the carrying case. (Another example of a tool 


that I carry just to show students what not to buy.) 


10. A bunch of different flat tension wrenches. Multiple sources and 
prices. These are much thicker than standard tension wrenches. They 
also really shine with top-of-keyway (TOK) tension. TOK tension 
usually allows more free space within the keyway for maneuvering 


your tools. 


11. A mix of standard tension wrenches. Multiple sources. The mix 
should include different thicknesses, widths, and shapes. 


BACK POCKET AND EXTERIOR 


I really like this little zippered pouch for keeping all my miscellaneous picks and tension wrenches. I don't go in 
here a lot since Im always on the lookout for the most efficient entry, which usually means a bypass. When Im 
stuck and I MUST make entry through a pin tumbler keyway, it’s nice to have these different options. 


Back Pocket and Exterior 


. Commercial shims for door latches. Multiple sources. About $15 
for a pack of six. These are well worth their weight in gold. Huge ROI 
as well. They work on multiple makes/models and setups. Most come 
in packs with two different thicknesses, which is often a godsend. 
Sometimes with the thin tool, I say to myself, “Not enough girth on 
this one,” and the thick tool saves the day. And sometimes the 
opposite works: Thicker to thinner. These are also very easy to replicate 


from materials in your environment. 


. Pick gun. I carry this only because I own it and it fits in the back 
pocket of my bag. It has never come out of the bag in all my entries, 


ever. I would bump key something before using this tool. To be 


honest, I could probably go without the weight of it in my bag. In my 
classes, I let students experiment with it, and most start off saying, 
“Oh damn! That’s one of those pick guns!” Sometimes the tool works. 
Sometimes. One of the main reasons I don’t recommend it is because 
of the price, $50 or more. Also, if you can use a pick gun, you can also 
probably rake or pick open a particular lock, and usually with less 
expensive and less bulky tools. I carry this as an example of a tool in 
which you probably shouldn't invest your limited funding and limited 


space. 


. Omni Torch from Polymath Products. About $15. Worth it. Buy 
two or three. They mount everywhere and can help you track things. 
Along with your hands-free headlamp, they make entry go more 
smoothly. 


. DoorJamm. $12. It’s lightweight and easy to store and carry. It can 
be used in a multitude of creative applications to keep entered 


obstacles unlocked. I highly recommend this. 


Tools inside the back pocket of my Second-Line Gear bag. 


This skill set is not designed for people who earn a paycheck solely by picking 


locks. If that were the case, I would organize my method of carry differently. 


I use this setup because it gives me multiple latch-shim and latch-jim options, 
multiple padlock bypass options, multiple decoding options (usually for four- 
digit combo locks), multiple privacy door unlock options, lots of wafer lock 
jiggler options, extra sets of lock picks for a different feel or different attack, 
loads of extra tension wrenches (because tension is just as important as raking 
and picking), two glass-break options, warded lock picks, tubular lock options, 
bump key sets, a pick gun option, a magnetic bypass option, a hinge pin attack 
option, multitools and a flashlight for various advantages, and a fence/wire- 


cutting option, all in a bag roughly the size of a lunchbox. 


Also, the bag carries some of my vehicle entry options like air bags and door 
pry tools, making it easier to walk onto a scene with a long-reach tool in one 
hand and a bag in the other, instead of fumbling around cradling everything in 


my arms. 


One of the reasons I recommend a smaller bag, especially a bag with shoulder 
straps, for your Second-Line Gear and not a huge duffle bag, is ravel. It’s 
probably not inconvenient to toss this small bag in the trunk of your car and 
forget about it until you need it. Then it would be easy to sling over your 
shoulder and take with you on a hike or on a bike, over a fence, or up a ladder. 


By design. 


There is no way that tools on your belt and in your pockets will raise the entry- 
percentage bar high enough for you to go through the world with the 
confidence I’m hoping to give you with a Three Lines of Gear setup. I’m 
aiming to give you the highest percentage of likelihood of a successful entry 
with the /east amount of gear carried into the field. That is another reason why 
a small, lightweight, hands-free bag is my recommendation for your Second- 


Line Gear. 


THIRD-LINE GEAR 


Third-Line Gear is defined as “tools that don’t fit into either of the first two 


categories; large tools, unique tools, or backups.” The trunk of your vehicle is a 
great place to store your larger Third-Line Gear items. Most of my gear in this 
category is long, straight tools like vehicle reach tools and a sledge hammer. 
When I was active in law enforcement, I kept a small gap in my trunk between 
the rear bumper and the rest of the shit in the trunk, and I stored all my reach 
tools and my sledge hammer, etc., longways, left to right, just inside the trunk. 


Large and long tools make up most of this category, but it also includes tools 


that don’t make sense being in your First-Line Gear or Second-Line Gear for 
whatever reason. For example, it doesn’t make sense anymore for me to have a 
specific make/model vehicle keyway decoder in my Second-Line Gear because 
I am no longer working for an organization that manages a fleet of 600 of the 
same make/model vehicles; meaning that specific key decoder tools probably 
wont get a lot of use in my gear lineup. Another example of Third-Line items 
that don’t make sense in a Second-Line go-bag are key tryout sets. Sometimes 
you can buy these huge keyrings that include 20, 30, or 50+ keys, all with 
different cuts. They’re big, bulky, and heavy, and they make a lot of noise—not 
a smart item to include in your Second-Line Gear (unless, of course, there is a 
50-piece Ford vehicle key tryout set you would routinely use if you were an 


employee at a Ford dealership.) 


I highly encourage creativity and customization. Because of changing 
technology and your changing skill set and budget, along with your trying new 
tools that do or don’t work for you, your gear organization should always be 


changing. 


(Pro Tip: In law enforcement, and in your daily life, too, it’s recommended 
that long objects not be stored with their length running from front to back so 
as to minimize the possibility that if your vehicle is rear-ended, your long 
metal tools might be pushed forward into the rear passenger compartment 
and impale someone. Instead try to store long items running left to right in 
your trunk.) 


THIRD-LINE GEAR LAYOUT 


It doesn’t matter if it’s a closet at your office, the trunk of your personal or 
work vehicle, or a large duffle bag at your home or in your garage, it should 


make sense for you. Here’s what I carry. 


1. Sledge hammer. Multiple sources, sizes, and prices. Sledge 
hammers will work on several types of door setups. Although battering 
rams are better IMHO, they’re very expensive and not really 
appropriate for your average daily life. At the time of this writing, I 


dont routinely carry a battering ram anymore. 


2. Right-angle pry tool. Multiple sources. I have a homemade tool 
that resembles what police and fire carry, called a Halligan tool, 
Halligan bar, or hoolie tool (a slang term). Professional Halligan tools 
can cost more than $200. A crowbar can also suffice (kind of). If you 
have a good hoolie tool, the chances of needing a crowbar are pretty 
slim, though the extra length of a crowbar can provide extra leverage. 
The problem is that most crowbars have a J shape at the end and not 
an L shape. This is a problem because it’s really difficult to fit a curved- 
angle pry tool (as opposed to a right-angle pry tool) into the gap of a 


doorframe. 


3. Bolt cutters. In my TLP course, I teach an entire instruction block 
on bolt cutters. Here’s a quick preview: 
¢ Not all bolt cutters are created equal. Size, price, quality, and 


cutting ability vary. 
¢ You can’ carry a bolt cutter on your belt. 


¢ Sometimes the lock’s shielding or environmental shielding 
prevent you from accessing a padlock to cut it, presenting an 


obstacle in the way of the shackle. 


¢ When bolt cutters do work, they are invaluable. 


4, Under-door tool. Multiple sources (including creating your own 


from the environment). I got mine from Sparrows for about $30. 
(Pat’s Recommendation: If you are just getting into lock picking 
of the tactical nature and you already have some rake tools, pick tools, 
and tension wrenches, I would buy one of these ASAP. Of all the tools 
I own, this is by far my number-one favorite. Even in very, very high- 
security government, military, and private facilities, on doors with 
high-security digital locking mechanisms and keyways, you can often 
just reach right under the door and pull the handle from the far side. 
This thing is scary-fun to use.) 


. Double-door tool. I got mine from Sparrows (shocker) for about 
$16, and I really like it. Anytime you're able to look through the crack 
between double doors, there’s a good chance this little tool can act as 


an extra hand to do a badass reach-around, to help make entry. 


. Vehicle entry reach tool, a.k.a. Gold Finger tool. About $22. This 
tool comes in many different lengths, shapes, and sizes, and some 
models are available in different thicknesses and flexibility ranges. I 
like the Gold Finger tool because I can bend it into the shape I need 
for a specific entry. I also like that some models have two different 
“finger” shapes, one at each end, to help manipulate plungers, buttons, 
or levers and even to scoop up a keychain left on a seat. Downsides are 
that the tool’s flexibility sometimes causes it to wobble a bit when 
attempting to make contact with a target and its springiness can make 


it hard to use to “push” things. 


. Vehicle entry straight stick tools. Some vehicle reach tools are 
simple rods with no flexibility. They're not crazy-expensive so I keep 
them mainly as backups. One set includes a claw-type tool, or claw 
grabber. That one tool is worth the purchase of the entire largely 


useless straight stick set. Some older models of vehicles have up/down 


plungers visible through the windows. When you do come across 


those, the claw tool offers a huge advantage. 


8. (Not shown.) I have many more tools in my home office that 
sometimes make appearances in my Second-Line Gear or Third-Line 


Gear, including key cutters, tryout keys, decoders, and spares. 


Because most tools in the Third-Line Gear category are long but not too wide, 
they’re often easy to store in the trunks of vehicles. The really thin stuff is great 
to store under the trunk’s carpeting; I place items like coat hangers and my 

under-door tool flat under the layer of fabric covering the floor of my vehicle’s 
trunk. They stay out of sight and out of the way, they take up almost no space, 


and they are always there when I need them. 


If it’s too big to fit in your First-Line Gear or Second-Line Gear, it might be a 
good fit in your Third-Line Gear. Large items, long items, and heavy items 
work really well here. Store them in a way that works for you, whether that’s a 


closet, the trunk of your car, or a big plastic bin in the back of your office. 


CONCLUSION 


¢ If you are in any way interested in developing a preparedness mindset, 
a few small, lightweight tools should always have a home in your 


wallet or on your keychain for Everyday Carry (EDC). 


¢ You should also consider a go-bag for your Second-Line Gear. It is 


highly recommended this be hands-free. 


¢ Do consider storage options for larger tools and administrative items: 


¢ key blanks if you dabble in key cutting 

¢ key-cutting machines 

¢ industrial bolt cutters 

¢ power tools if used with the proper knowledge 
e axes and crowbars 

¢ lighting options 

¢ duplicate tools 


¢ You absolutely do not have to purchase and carry every tool I have 
listed. 


¢ You should always be reassessing your setup, retaining what is useful 


and discarding what is not. 


¢ If you are attempting an entry and you say to yourself, “I wish I had 


this one tool,” consider adding it to your gear. 


¢ Be aware that some lock-picking tools will market themselves as 
perfect and all-powerful but they are not. (I do not recommend 
buying any “200 lock picks for $200!” sets. Not all, but most, of these 


are a rip-off and at best redundant.) 


¢ Some items are so valuable, inexpensive, or delicate that it’s a good 


idea to carry multiples. 


¢ Gloveboxes and center consoles of vehicles are great places to store 


duplicates and backup tools. Here’s what I keep in mine: 


¢ handcuff keys 

¢ backup set of Sparrows Mace picks 

e safety pins, bobby pins, and paper clips 
* tape 


Please note that as an instructor, and as an “entry specialist” on scene, I have 
listed several items in my Three Lines of Gear that are duplicates. One reason 
for duplicates? Consider the maxim “Two is one, and one is none.” It’s very 
reasonable to carry duplicates of small, inexpensive tools, especially tools that 
damage easily. Duplicates are also helpful for handing to someone else on scene 
(as in the case study “Broken but Not Dying”) and not worrying about losing 
those tools if you don’t get them back. I also carry tools of varying value so I 
can show my students what doesn’t work and let them experience using tools 


of similar use but different qualities. 


CHAPTER 5 
CASE STUDY: SUICIDE BY PILLS 
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in the case study.) 
“Three-William-Sixty-One, can you be 51 to a Signal 32? Called in by the 
adult daughter of the victim. Victim is locked in the master bedroom with a 


note outside the door. Daughter can’t get into the room to assess.” 


‘Dispatch, Pll be 51. Priority 2,” I responded and started driving quickly with 


my lights and sirens on, since this was called in as a suicide attempt. Seconds 


mattered. 


STEP 1 AND STEP 2: MRE AND SPEED/LOU 


I would have to confirm and adjust on scene, but it would appear that we 
already had MRE because (1) a family member on scene would be allowing us 
entry and (2) a note on a door indicated a possible suicide attempt, so we'd be 
going in to save a life. It would also appear that we'd have a degree of 


heightened Speed and changing Levels of Urgency. 


I arrived on scene at the same time that Deputy J pulled up. I grabbed my 
Second-Line Gear bag, and the two of us walked briskly toward the first-floor 
apartment. If the few small tools I had in my First-Line Gear in my pocket 
didn’t get the job done, it would be nice to avoid having to go back and forth 


to my vehicle for more gear, wasting precious time. 


The 911 caller, the victim’s daughter, was standing outside her mother’s 
apartment door. She told us, “My mom lives by herself in this apartment, and 
we usually chat once a week. She missed our phone call today and wouldn't 
answer her phone. I showed up with my key and entered the apartment, but 


she was locked in the master bedroom with a note hanging on the door.” 


Roughly, the note read: “I took a bunch of pills. Please don’t come in. I'll 
probably be dead by the time you read this.” 


With the daughter’s permission and a reasonable expectation this was a 


legitimate suicide attempt, we entered the apartment to do what we could to 


help. 


I checked the corners and closets and peeked into empty rooms as I made my 
way toward the master bedroom. Unfortunately, there are times when people 


dissemble or create a setup for an attack or ambush, or with their death they 


want to “take someone with me.” So just in case, I confirmed the scene 
secured. As I stood at the master bedroom door I observed that the door, 


which was a push door with a privacy knob, was locked and the note was 


hanging on it. To my right, a door opened into a hallway bathroom. 


Master bedroom door and an adjacent bathroom. Old and inexpensive privacy knobs like these usually have a 
twist lock or a push-button lock on the inside, and on the outside they have a small hole that can be used to 


access a lock override. 


A reenactment photo showing a push door, an inexpensive privacy knob, and a note hanging on the door, 


reading, “This is only a reenactment of this case study with a similar apartment setup, not a real suicide note. 


— Pat©. ” 


STEP 3: ATTACK VECTOR IDENTIFICATION 


At the time, my understanding was that the only option for entry was through 
the master bedroom door. It was a privacy door—a basic, plain “vanilla” door 
—top to bottom. It was also a push door that could be kicked in with minimal 
effort. It had one doorknob, a privacy knob, on the left-hand side. The knob’s 
only feature was a small hole in the center. I knew I could attempt a shim 
technique to slip the latch from the push side of the door. I also knew that, at 


the time, I did not have a tiny screwdriver or a Kwikset emergency key in my 


kit. 


Defined: Privacy knob: A doorknob with a simple push-button lock or a twist lock on the 
inside and no keyway, but sometimes a small hole on the outside for emergency unlock 
access. 


At this time, my partner, Deputy J, was standing shoulder to shoulder with me 
and one of our sergeants was stationed behind us. Fire and EMS had just 
arrived on scene. One of the responders had a heavy axe and hoolie tool in 


each hand and another was carrying medical response bags. 


Side Note: There was an intimate moment (for me at least, and not sexually intimate, 
but significant to my soul) where | observed the firefighters and EMS workers enter the 
apartment. One of the firefighters casually rested a huge axe and hoolie tool on the 
floor, leaning them up against the apartment wall. The EMS workers set their medical 
response bags by the front door, waiting for me and the other deputies to make entry 
into the master bedroom. The ballet of nonverbal communication, the way people 
interacted with their gear and wordlessly with one another, left an impression on me in 
a way that I’m almost certain it did not for anyone else in the room. 


STEP 4: MANUAL UNLOCK ATTEMPT (CHECK, 
BREATHE, CHECK AGAIN) 


I banged on the door and as loudly and politely as possible delivered the 
boilerplate: “Hello? Are you in there? Are you okay? Sheriff's office. We're here 
to help you with some nice EMS folks! Can you hear me? Can you respond to 


me?” 


I took the first physical step for my on-scene entry: I manually checked to 
make sure the obstacle wasn’t already unlocked, took a deep breath, and tried 


again harder. The door was in fact locked. 


I was able to hear a TV or radio through the door, and I was also able to hear 


someone respond though not coherently. 


Right away Deputy J asked, “Hey, Sarge, you all right if I kick this door in? 
We'll have this call wrapped up in two minutes flat.” The sergeant considered, 


then approved the move. 


I ventured a suggestion. “Hey, Sarge” I said, “I’m all for letting Big J here get 
his exercise, but let me run something by you first. This would not be the first 
time someone attempted suicide but then changed their mind and decided 
they wanted help. And if this woman’s sick to her stomach from pills and starts 
crawling toward the door to unlock it for us, or if she’s lying there now with 
her head facing the door and we kick the door in, there’s a good chance we 
might kick it right into her head. How about this? If I can’t open the door with 
my tools, then we let Bubba J here kick it in.” The sergeant considered my 
suggestion. And approved. 


STEP 5 AND STEP 6: TOOL AVAILABILITY AND 
“NOW OR LATER” 


I had my Second-Line Gear bag with me and this was a pretty simple low- 
security entry so now was the time. Right? What else could I possibly assess? 


(Famous last words. I should have started a timer.) 


Pro Tip: If you push in on a door toward the top, you can usually gain some 
wiggle room to insert your shim. 


Aare 


Check to see if an obstacle is already unlocked, take a deep breath, and try again... harder. 


My Second-Line Gear bag on scene and accessible. Having your First-Line Gear and Second-Line Gear with 


you and your Third-Line Gear nearby, and knowing what is in your gear can reassure you on scene. It can keep 
you calm by preventing you from wasting precious time and mental energy wondering which tools you have on 


hand or you wish you had. 


(1) The door resting shut with a tight tolerance, making it difficult to get a shim to fit. 


(2) The upper door area pushed in by hand, creating extra space for inserting your shim tool. 


The Target Assessment phase was on hold while I started my entry attempt. I 
quickly pulled a clear-plastic commercial shim out of the bag at my feet. At 
first it was a little tough getting the shim into the door jamb. 


Fun Fact: Some very high-security facilities make it very easy to use a shim 
technique because of certain bureaucratic installation practices, while some 
very low-budget homes and apartments make it difficult as fuck due to some 
oddly tight tolerances in the doorframe and layers and layers of sticky paint. 


I now had the shim right up against the latch. I applied both a pushing and a 


pulling force on the door while continuing to try to drive the shim through the 
latch. No luck. I started to feel a little embarrassed. I knew this was a cheap 
door. I knew the way into the room was through the simple privacy latch. I 
also knew the only other option was a tiny screwdriver or a privacy knob 
emergency key, but I didn’t have either of those in my kit. I continued to 
struggle. 


Meanwhile the sergeant meandered around the corner. 


“How long is that gonna take there, hot shot?” My country bumpkin partner 
was happy to prod me. 


“Dude, I know I can do this. I’ve done it a hundred times before,” I replied. 
“Shitty door,” I added under my breath. 


I felt a tap on my shoulder. I was not in the mood to hear whatever Deputy J 
had to add, but it turns out my door-kicking partner wasn’t the one tapping. It 
was the sergeant. He extended his hand toward me, palm facing up, and on it 
was an emergency key. He wasn’t mocking me; he wasn’t all puffed up about 


how smart he was; he simply said, “Here ya go.” 


Three seconds later the door was unlocked, EMS went in to assess the victim, 


and I learned a few things about myself and about this skill set. 


I really like this case study because the flow was pretty straightforward. The 
Target Assessment phase proceeded almost perfectly in order, and I 
remembered to do quite a few things (though certainly not everything) the 
right way. 


I also really like this case study because of all the emotion and the human 


interaction between the victim and the responding officers, between the 


officers and the firefighters, and between the sergeant on scene with J and me, 


the deputies. 


A view of the master bedroom door from inside the adjacent bathroom. Notice the mirrored door of a medicine 


cabinet. 
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Small items on shelves that are high up and hard for young children to reach. I think there may be a lesson 
there we can discuss later in this book... 


A shelf in a bathroom’ medicine cabinet and on it a Kwikset emergency key used in millions of homes across the 


country. 


T also really like highlighting the surprising fact that inexpensive infrastructure 
can sometimes have unintended security features, like a tight-fitting and sticky 
door jamb, which can hinder entry specialists. Conversely, I’ve used a 

laminated sheet of paper to perform this same shim technique to gain entry to 


a secure room inside a secure multimillion-dollar government facility. 


LESSONS LEARNED 


The door latch was not the only way into the bedroom. The apartment 
was on the first floor, which meant that while I was working on the 
lock, my partner could have been checking whether the bedroom 
window was unlocked and whether he could see into the window to 
assess the status of the victim. Doubling up our efforts, we could have 


made better use of our resources on scene. This was a failure of mine. 


I knew what tool would have opened that door and I didn’t have one 
in my kit, though I had one at home. Problem corrected. I now carry 
multiple privacy knob tools. For every residential front door in this 
country there are dozens of privacy doors that can be opened using 
major-brand emergency keys, whether a small flat-head-type key or a 


pin-like punch tool (shown in my Second-Line Gear). 


I knew damn well all about the Two-Step Rule: “If there is a key or a 
code stored nearby, it is often within two steps or possibly an arm’s 
length of the locked obstacle.” There were plenty of people on scene 
who could have been sent to look for backup keys. Or I could have 
asked someone if they had a tiny screwdriver in their vehicle. I was 
excited to help and I knew, at first glance anyway, this was a very 
simple entry requiring a very simple tool. You could say I got “sucked 
in” (using a tactical term). A way to avoid this is to set a timer in your 
head, forcing you to step back from a technique that is taking too long 


and to reassess from the top. 


Locked obstacles can be counterintuitive. The snug fit of the 
doorframes of some low-budget apartment doors plus their layers of 


cheap paint makes for a very tight and a very sticky place for you to 


try in vain to shove your tool (insert your own adult joke here). Low- 
budget apartment doors can therefore have a surprisingly high level of 
security for certain Attack Vectors. On the other hand, government 
facilities ’'ve been in have doors whose latches and latch strike plates 
are vulnerable to a simple attack with a coat hanger, pocketknife, or 


laminated piece of paper. 


I now have two sets of emergency keys in my Second-Line Gear. 


Cheap door, cheap frame, cheap latch strike plate, shitty installation. A surprisingly 


effective defense against shim attacks! 


e There are several things in your environment you can makeshift into 
the two types of privacy keys that are the most common in the US 
(the Schlage and the Kwikset emergency keys). A small Phillips or 
flathead screwdriver can work well for this. So can the inside of a 
ballpoint pen, removed from the casing, as well as some pen caps with 
the right shape and length. As a kid, I often used a double-sided 
cotton swab with the cotton peeled off to get into several locked doors 


at home. 


e¢ I learned a little humility. It’s embarrassing to admit, but the truth is 


that I was overly confident about opening this cheap lock with a basic 


tool and saving the day and looking cool doing it. 


I'm still happy we didn’t kick the door in right away. I call that a win. I 
call much else of what happened a loss. Everybody has good days and 
bad days; this was, on balance, a bad day for me. But I’m proud of the 
fact that failures constantly shape the high-quality curriculum that 
advances this field application skill set. Failures should not be hidden. 
They should not be frowned upon. There are reasons we fail, and we 
should identify them, implement solutions moving forward, and share 


those solutions with others. 


CHAPTER 6 
GUIDELINE: TWO-STEP RULE 


EVEN PROFESSIONALS MISS THIS! 


|| FIRE PANEL 
|| INSIDE 


— — 


(1) Access key card to a government dorm, stored one step away from the bedroom door it locks: Above the stove 
in the tiny kitchen, in the top-front corner of the cabinet. (The door it unlocks is visible just to the left of the fire 
extinguisher.) (2) Secure keypad entry code within two steps of the keypad: Written in pen, with a visual 
identifier (push pin) nearby. (3) Probably the second most common key storage location in residences, after the 
key under the mat: A privacy door key above a bedroom doorframe. (4) Two units on the back wall of a 


commercial building, indicating theres a key inside. 


Defined: Two-Step Rule: “\f there is a stored key or entry code nearby, it is 
often within two steps of the locked obstacle.” 


It may make sense to check the area within two steps of a locked obstacle for a 
key or a code sometime before, during, or after your Target Assessment. Or it 


may not be necessary at all. 


Hidden keys are very common in certain environments and not so common in 
others. It would make sense to look for a hidden key first if the lock would 
require more than a 10-second entry and if the environment would be likely to 


have a stored key. What are some of those environments? 


Residential homes with a private or semiprivate front porch having 


lots of nooks and crannies where small items can be hidden. 


Apartments with separate (not linked) entryways. 


e Office desk drawers (locked or not). Most standard locked desk 
drawers are held shut with inexpensive and low-security wafer locks; in 


a pinch a few paperclips will open them. 


e Work areas accessed by many employees. A 24-hour facility that 
workers need to access at different times of the day or night is more 


likely to have stored or hidden keys. 


If there are extra hands on scene or if it the facility is large and a full perimeter 
check would take a while, I’d send someone to look for hidden keys and codes. 
I'd also check around an entry area for a minute or two after each unsuccessful 


attack on a specific vector and before moving on to the next. 


You might not need to check the two-step area at all, depending on whether 


youre pressed for time or whether youre certain of making a successful entry. 


As in the case study “Rescuing Man and Man’s Best Friend,” if I saw an 
exposed simple latch I would try a pocketknife or my pocket-size latch jim tool 
with the expectation of success. If I identify an easy entry point and I have the 
right tool and entry would take me fewer than 60 seconds, start to finish, it 
would be silly to spend five minutes looking high and low for a hidden key. 
Again, the economics of time management is a huge factor in Tactical Lock 


Picking. 


The Two-Step Rule is nothing new and nothing proprietary. I first came across 
it in a book a decade or more ago. I’ve tried in vain to find the source. (If you 


know of such a book, please contact me. I'd be happy to credit it.) 


If someone does store a key to their front door somewhere outside the home, 
the hiding place is rarely around the side of the house, over a locked gate, up a 
second-story balcony, or under a 75-pound flowerpot. Security is a 
balancing act between effectiveness and efficiency (a.k.a. ease of 
access a.k.a. laziness). On returning home from a long, miserable day at work 
to discover you're locked out of your front door, you probably wouldn't want 
to put too much effort into finding a spare key. Youd likely rather just reach 
under the doormat. (Again, this is more common when your home or at least 
your front door is semiprivate. The more private and secluded a home and a 


front door, the more likely you are to find a key within the two-step range.) 


Have you ever put a key inside a drawer and thought, “This isn’t the most 
secure place for a key, right up front in this drawer,” and then pushed the key 
to the back of the drawer for a little extra “security?” Maybe covered it with a 
scrap of paper? It’s okay. This is not an attack on you. I’ve done the same thing 
dozens of times! It’s a calculated risk we all take, and the point is that the way 


people think about security often falls into certain patterns. 


Guards! Guards! 


of the least likely claimant—“even someone like Brother Dunnykin.” He 
stared at the assembled Brethren. “Don’t see him here tonight, by the way.” 

“Funny thing, that,” said Brother Watchtower thoughtfully. “Didn’t you 
hear?” 

“What?” 

“He got bitten by a crocodile on his way home last night. Poor little 


bugger.” 

“What?” 

“Million to one chance. It’d escaped from a menagerie, or something, 
and was lying low in his back yard. He went to feel under his doormat for 
his doorkey and it had him by the funes.”' Brother Watchtower fumbled 
under his robe and produced a grubby brown envelope. “We’re having a 


Guards! Guards! — Terry Pratchett (1989) 


The Ultimate Hitchhiker's Guide to the Galaxy 


is house was still there. 

How or why, he had no idea, but he had decided to go 
and have a look while he was waiting for the pub to 
empty so that he could go and ask the landlord for a bed 
for the night when everyone else had gone, and there it 

was. 


z hurriedly because, astoundingly, the phone was ringing. 


He had heard it faintly all the way up the lane and had started to 
run as soon as he realized where the sound was coming from. 


So Long, and Thanks for All the Fish — Douglas Adams (1984) 


Common examples of the Two-Step Rule: 
¢ key under the mat 
¢ key above a door frame or a railing 
¢ key under a flowerpot 
¢ key in a top desk drawer 
¢ key in a mailbox 


¢ key inside a small box or enclosure near the door 


¢ key inside a front-lawn or garden ornament 


¢ car key magnetically stored under vehicle frame (this is less common 
because of key fobs and smartphones but still worth a shot if youre 


morally making entry into a locked vehicle and are low on resources) 
¢ code written on a dry erase board or corkboard 
¢ code written on a sticky note in a drawer 


¢ key stored under a stone frog in the garden (sometimes the best fiction 


is the best because it so closely mirrors reality) 


Here’s a selection of mini-case studies that show the Two-Step Rule in action, 


including some that show slight modifications to the rule. 


MINI-CASE STUDY: THE VALUABLES CABINET 


I was traveling and had the chance to spend a few hours in a semiprivate 
airport lounge with my dying cell phone. A staff member offered to charge it 
inside a locked cabinet. How wonderful that I could let my phone charge 


without having to guard it like a ninja while I took a short nap. 


Except the cabinet was out of sight of the staff member’s station and in an area 


where members of the public had unrestricted access. Hmm... 


A simple locked cabinet utilizing a low-security wafer lock. 


The staff member walked me to the cabinet, opened the cabinet door, set my 


phone inside on a charging cable, closed the door, and locked the door’s simple 
wafer lock with a key. Better than nothing. Wafer locks (sometimes called 
cabinet locks) will keep out a majority of the wrong hands. No complaint from 
me. I wasn't worried about Jason Bourne stealing my cell phone so he could 
hijack my nudie pics. I was more concerned about a quick swipe in the form of 


a crime of opportunity. 


The staff member opened the drawer above the cabinet and said, “Don’t worry. 
It'll be safe. See? P'Il take the key and hide it away in the drawer here. And I'll 
just put the key in the front corner of the drawer so you'll know where it is if 
you need it and I’m not around.” The staff member then winked at me. (The 


staff member was actually very sweet.) 


Deep breath. The “corner of the top drawer” storage spot for hidden keys is 
remarkably common. It is so common that I check desk drawers for fun even 
with no locked obstacle nearby. In every course I teach I tell students, “A/ways 
check the top drawer of any desk or cabinet you come across in the same room as the 


locked obstacle youve targeting.” 


An unlocked drawer above a locked cabinet space. 


The arrow indicates the storage space for the key to the locked cabinet below. 


MINI-CASE STUDY: THE DOUBLE DESK 


This case took place in a small secure building inside a huge, sprawling secure 
complex with active operations 24/7. The building consisted of an open office 
with four desks, one in each corner, and a locked supply closet that ran the 
length of the far left wall. The supply closet was about the size of five or six 
walk-in closets. The door leading into the supply closet was the room’s only 
interior door. There were no cameras, alarms, or electronic tracking systems, 
though the supply closet easily had more than a quarter-million-dollars’ worth 
of supplies. The key to the supply room was “regulated” (LMFAO) and issued 


only to people of a specific rank. 


A very common key storage area: the top left (or top right) of the topmost drawer in a cabinet or desk. 


Later, with students, during a training evolution on this same door, even if we didnt find keys within the two- 


step range, we were able to use a pair of paperclips from the nearest desk to successfully pick open the lock. (My 
actual student at the actual door.) 


I had a fucking hunch that the key to the supply room door was in one of the 
desks. For verification, I applied the Two-Step Rule. I checked all the drawers 
of the desk on the left (the desk closest to the supply room door). None of its 
drawers had any keys. My pattern-seeking brain told me to look further. 


I strolled to the second-closest desk to the supply room door, and just inside 
the top drawer was not only a key but also a keyring with several keys. One of 


those keys opened the door to the supply room. 


This is the Two-Step Rule in action but also kind of an exception. The key was 
stored in a nearby desk in the corner of a drawer, but it was the second-closest 
desk to the locked obstacle, making it not two steps away but more like eight 


steps. So the rule was close. 


Even if we couldn't have picked the keyway on the doorknob, we still wouldve been able to use a plastic shim 


(similar to a really thick sheet of laminated paper) to gain entry into the secure space with its more than a 
quarter-million-dollars worth of supplies. My student successfully shimmed the shitty latch into the unlocked 
position and made entry through the locked door. (A photo I took from the inside while the student attempted 
entry from the outside.) 


Note: My students and | had both moral and legal (policy) permission to access the room 
for this case study, while, yes, the key was “regulated at a higher rank.” 


MINI-CASE STUDY: THE CONCERNED BOYFRIEND 


When I was working in local law enforcement, it was very common to conduct 
what we referred to as welfare checks. No, not slips of paper giving people 


welfare funds but checkups on people to ensure their well-being. 


The screen that popped up on my in-car computer read “welfare check” along 


with an address. 
Here are some details: 
¢ The welfare check was on an elderly woman with a known illness. 
¢ She had a boyfriend/significant other who was a truck driver. 
e The boyfriend called her every night at the same time from the road. 
¢ He was worried because she missed his most recent call. 
¢ He was a resident in her home. 


¢ He gave local law enforcement (us) permission to make entry to check 


on the woman's status. 


¢ The patrol lieutenant made contact with the boyfriend via phone, and 


my lieutenant authorized and approved entry into the home. 
I gained all of this information before | arrived on scene. 


On scene, my lieutenant, two other deputies, and I stood at the front door of 
the woman’s house. (Don’t ask me why there were four of us, it must have been 


a slow night.) 


The lieutenant, who spoke to the boyfriend on the phone, said there was a key 
hidden inside a garden hose box on the side of the property. He asked me, as the 
entry expert, what I wanted to do. I (visually) assessed the difficulty of picking 
open the front door and looked for bypass options. I determined that there was 
a medium level of security. Knowing there was a spare key nearby and roughly 


where it was located, I decided not to waste my time picking. 


Of course, we were concerned about the possible loss of life. We noticed a 
vehicle in the driveway, and listening through the front door, we heard a TV 
on at full blast inside the house. There was likely someone inside: the elderly 


woman. 


More than one of us tried the handle and then tried it again to make sure the 


front door wasn’t actually unlocked. 


I then walked around the house to find the spare key. One of the deputies went 
with me to assist in peeking inside windows to look for signs of life or signs of 


death. We were familiar with both. 


I walked through the gate of an (unlocked) wooden fence and went all the way 
around to the back of the house. I noticed the garden hose coiled around a 
wall-mounted box with a little swing door. I looked inside and didn’t see a key. 
I radioed the lieutenant and he seemed certain the information the boyfriend 
provided was correct. I searched the box and found the key duct-taped 
underneath the bottom, out of sight. Wow! Good for you, lady! Taking 


multiple steps to prevent someone from easily finding of your spare key. 


The four of us were now back at the front door of the house. We could still 
hear the TV at full volume. 


We discussed whether we had reason to suspect the woman inside was sick or 


dying, taking into account the permission to enter from the boyfriend, the car 


in the driveway, and no indication that anyone would be answering the door. 
We determined that entry was reasonable and morally right. Our sole purpose 


was the protection of life. 


I put the key into the keyway and unlocked the front door. I took out my taser, 
and the joking started: “What’s the matter, afraid a little old lady is going to 
beat you up?” I defended myself, citing the fact that cops are ambushed with 
false calls on occasion and reminding them that even with good intentions, 
cops sometimes enter the wrong house at the wrong time. But if you 
understand law enforcement “culture,” you'll know my arguments fell on deaf 
ears. Sticking to my guns, literally, I entered the house happy to help someone 
who might be in need but with my taser at my side—not to clear the house 


like a SWAT ninja but to be cautious. 


I found the elderly woman covered with a blanket, completely still, lying on 
the living room couch in front of the TV. My first thought was, “That’s the 


way I want to die. On my couch, under my blanket, in peace.” 


I next took steps to confirm the medical status of the resident. I shouted. No 
response. I grabbed a toe sticking out of the end of the blanket and shook it. 
No response. I leaned in to confirm there was no pulse. The woman screamed 
at me and I screamed back. I jumped high enough to just about hit my head 


on the ceiling fan. (If you must know, I love reading zombie fiction. Well, 


loved...) 
The guys got a good laugh. 


The woman was actually very thankful. She chuckled a bit, too, having 
narrowly avoided a surprise-induced heart attack. She called her boyfriend and 
told him that she was fine and that she loved him. She had fallen “dead asleep” 
(phrasing, am I right?) watching TV but was as healthy as could be. 


Lesson: In the chapter “Guideline: Target Assessment,” | will provide a standardized order 
of operations. You are encouraged to alter the order on scene if it makes sense to do so. In 
this case, there was no need to check whether windows were unlocked during my walk 
around the house. There was also no need to pick the front door lock for even 30 seconds 
just to give it a try. Listed below is a brief look at how the steps of my Target Assessment 
and Entry phases applied to this case study. 


Step 1 and Step 2: MRE and Speed. Permission granted, and 


moderate/medium speed required. 
Step 3: Attack Vector Identification. Skip. 


Step 4: Manual Unlock Check. Tried the door handle multiple 


times. 


Step 5: Tools Available. Known key, known location. Skip. Pause 


Target Assessment phase to start an entry attempt (key retrieval). 


Step 6: “Now or Later.” Moot point. Now, obviously. Entry attempt 


successful. 


Step 7: Other Resources. Not needed. Entry achieved before we 


were required to search for any other resources or to reassess our target. 


MINI-CASE STUDY: THE PERFECT ANGLE 


Over my more than a decade of working in government operations, I’ve had to 
check on hundreds of alarms on everything from ammunition boxes and 
armories to residential homes, commercial businesses, and government 


facilities. 


On this night, I was notified of an alarm. The location consisted of a confusing 
address in an out-of-the-way area where I’d never been. But the clock was 
ticking. I drove with a partner down a long and lonesome road and arrived at 
the address only to discover it wasn’t actually the building sounding the alarm. 
There was a disparity between that building and the address where the alarm 
program sent us. Same property, different building. My partner and I had to 
drive around the property to a different area to finally find the building that 
was going “Eep, eep” in the middle of the night. 


We parked a short distance from the building and conducted our perimeter 
search. We found no evidence of forced entry or signs of movement inside the 


facility. 


e perimeter search complete, my partner and I met up at the front rollu 
The p t h plete, my part d I met up at the front rollup 
garage door to the facility, which was a large storeroom with quite a bit of 


expensive equipment inside. 


The garage door was, surprisingly (actually, no...not surprisingly), set a few 
inches back from the outer wall of the facility, resulting in a big fucking gap 
between the garage door and the connecting brick wall. You could see a good 


deal into the facility through the gap. 


My partner and I both identified a green-backlit alarm code panel mounted on 


the wall next to the garage door. 


Lesson: “Security is a balancing act between effectiveness and efficiency.” Many facilities 
with large numbers of employees need some way of sharing information about security 
procedures and protocols. These facilities need to provide just the right amount of 
security information to people who require certain types of access but not too much 
information too freely so they lose control of it. Sometimes a tall order. 


Our first glimpse through the gap in the garage door for this case study. 
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A closer look at the note posted above the ‘alarm panel. 


Just a few inches above the alarm keypad panel was posted a sheet of paper. 
“You've got to be kidding me,” I said out loud. “Hey, so...” I said to my 


partner. “We were sent here to check on the security of this facility...” 
“Yes.” He replied. 


“And they have an alarm system installed, including an alarm panel like the 


one we're looking at.” 
“Okay. And?” he asked. 


“And we're here to make sure there’s nobody inside fucking around, right? But 


we don’t have the key to the facility and we can’t actually force our way inside.” 


“Yes, right.” 


“Look at the alarm panel, and tell me what you see posted a few inches above 


» 


it. 
“A couple of numbers? Four-digit codes?” 
“And can you make out what it says next to those two four-digit codes?” 


“Um...four numbers, then ‘open,’ and then four numbers below that, and 


‘close.”” 
“So if you were a criminal and you had two brain cells, you could have broken 
right through this front door, gone inside, closed the door, and punched in the 


alarm cancel code, am I right?” 
We both shrugged. 


While the facility contained expensive equipment, it was not Fort Knox. There 
was a balancing act going on here between effectiveness and efficiency. The cost 
in time, labor, money, and inconvenience for having to deal with the local 
police responding too frequently to false alarms probably outweighed the risk 
of posting both the open and the close codes right above the alarm panel. 


This case study was a fun one to experience as a professional first responder 
because I was able to see both sides of the security equation. As a teenager I 
worked as a low-level employee for a facility where morning-shift workers had 
very early start times. On my first day of training, I was taught how to open up 
the storeroom (a garage area) and what to punch into the alarm panel. “The 
alarm cancel code is written right here above the panel if you ever forget,” my 
trainer told me. “We hire so many new people who keep forgetting the alarm 
code when they open in the morning before the owners get here, and we're 


charged money every time the police have to respond to the alarm going off so 


we just wrote the code there on the wall,” the trainer added nonchalantly. Now 


as a first responder working this case study, I understood. 


There is no “perfect” security. All security should follow a layered approach and 
be upgraded and reassessed constantly to prevent specific attacks as well as 
multiple types of attacks. The Two-Step Rule applied here but in a strange, 
exception-to-the-rule kind of way. The code was written down within two steps 
of the inside, not the outside, of the locked obstacle. And the code wouldn't 
have helped anyone make entry, though it would’ve helped them “cover up” 
their entry. I’m happy to include this case study because along with teaching 
people how to achieve entry and to escape through locked obstacles, I teach 


them how to improve their own security. 


KEY STORAGE BOXES 


Key storage boxes definitely count within the Two-Step Rule but in a unique 
way. Some residential and commercial structures have key storage boxes 
mounted on the outside, whether hanging from a doorknob or door handle or 
mounted on a wall or a post, or even slightly hidden at the front, side, or back 
of the building. In my courses, I teach several different methods for attacking 
these units, such as guessing the combination, using a tool to decode the key 
box, looking up manufacturer master codes, and using a Keyed Alike set with a 


matching make/model key box, and more. 


FIRE PANEL | 
INSIDE 


The back door to a commercial business. On the left is a Master Lock four-digit dial combination key box. On 
the right is what is called a Knox Box, which contains a key for first responders. These have wildly different 
levels of security strength. Sometimes having multiple locks or multiple stored keys in different locked obstacles is 
a bad thing for security. It’s often like a chain that can hold only the weight of its weakest link. 


Props I use for my course, offering multiple options for students to retrieve a key from a mounted key storage 


box. 


You can be searching for a hidden key and discover a key storage box mounted 
at eye level on an exterior wall, sometimes around the corner from a locked 
obstacle. Don’t forget to always check the rear of a house or facility. It’s 


common to find key storage boxes behind buildings near service entrances. 


LESSONS LEARNED 


It’s often worth a quick check of the immediate area of a locked 


obstacle to search for a hidden key or code before picking the lock or 
trying a bypass. 


If you have to search any farther than two steps, understanding how 


people commonly think can help guide your Target Assessment. 


If, based on the Attack Vector and the tool you have on hand, you're 
likely to make entry in fewer than 60 seconds, I wouldn't waste time 


looking for a hidden key. 


If you have a partner or extra hands on scene, as the entry specialist 
you should continue pursuing picking and bypass options while others 


look for a spare key. 


If during your Target Assessment you determine that entry could take 
longer than 10 minutes or even an hour or more, you might want to 


spend five minutes looking for a hidden key or code. 


If the locked obstacle is a door in a hallway, go ahead and take two 


seconds to look under a mat and above the doorframe. 


Many people still store a key to their home outside the home. The 


Two-Step Rule occurs often enough that it’s worth a shot. 


When a strict Two-Step Rule doesn’t yield a hidden key to you, you 
should check farther away for other hiding places that are commonly 
used or that fit a pattern. 


¢ If you're going to store a key outside your home, it’s smart to 
implement a few steps of extra security so the location isn’t plainly 


obvious. 


¢ Your Target Assessment phase can have many pauses in it. It can 
happen out of order. If you get stuck or become frustrated, the steps 
I’ve laid out for you can help you get back on track or they can help 


you notice things you might've otherwise missed. 


Learn as you go. And feel free to contact me with your own case studies. I 
would love to hear if the information provided here helped you in the field or 


even if it didn’t and you have suggestions! 


CHAPTER 7 
CASE STUDY: THE 
LIEUTENANT’S OFFICE 


The door we will reference for this case study. Note the heavy wood, solid metal frame, and push door handle on 
the left with a commercial-grade keyway. 


“Hey, Dispatch...” I heard the lieutenant’s calm, confident voice through the 


radio. 


“Go ahead, Lincoln-Twenty-Two,” Dispatch responded. 


“Yeah, Dispatch, go ahead and put Three-William-Sixty-One on a special 


screen at District Two and send him my way.” 


A screen popped up on my in-car computer. “Do you copy?” Dispatch asked 


me. 
“T’m already 51,” I replied. 


No fucking clue what was about to happen to me. Eight times out of 10 when 
people called me for special assignments it was for lock picking or something 
similar. But being called into the boss’ office and not knowing why added a 


layer of stress. Ha! 


I drove to the District Two (D2) parking lot, activated my garage door opener 
for the parking gate, drove into the employee lot, and parked. I wouldn't say I 
was nervous but let’s be real...who out there does like to be called into their 


boss’ office for an unknown reason? 


As soon as I walked through the door to D2, I saw the lieutenant and the Cool 
Sergeant (from the case study “Suicide by Pills”) standing outside the 
lieutenant’s office door. They were both fucking with the doorknob. I breathed 
a sigh of relief. 


“Hey, gentlemen! Can I give you a hand?” | asked. 


The lieutenant turned and looked at me with his usual mischievous grin 
(though this time it showed a bit of embarrassment). “You have your tools with 


you?” he asked. 


“Are you kidding me? Of course, I do.” I added: “This scenario is much better 
than the ones playing out in my head on the way here. I'd be happy to help!” I 
laughed a little and started the Target Assessment. 


STEP 1 AND STEP 2: MORAL RIGHT FOR ENTRY 
(MRE) AND SPEED/LEVEL OF URGENCY (LOU) 


I had a clear MRE from the lieutenant, and my Speed/LoU was almost zero, 
for now. But the Speed/LoU was subject to change very rapidly. If a member of 
the public happened to have an “Oh shit! I need help right now!” moment, we 
would need to make very different plans. Those plans would be complicated by 
the fact that the keys to lieutenant’s patrol car were locked in his office, along 


with his gun belt and his bulletproof vest. 


Learning those items were locked in the office, I thought, “That's odd...” (a 
phrase to pay attention to because it’s usually when the universe is speaking to 
us). Aloud I said, “Hey, Lieutenant, what would make you leave your keys and 


your gun b—” 


My face must have betrayed my thoughts because he interrupted me: “Because, 
I almost shit my pants running to the bathroom down the hall. Is that what 


you wanted to hear?” 
I almost died laughing. 


MRE: Granted. Speed/LoU: Administrative (the least-urgent level), for now. 


STEP 3: ATTACK VECTOR IDENTIFICATION 


A closeup of the keyway. It required a key that was a little longer than a normal residential key, meaning it had 


more pins to attack than a standard low-security residential lock. 


This door was a very solid door, and it was very solidly locked. 


I continued with a quick assessment of the door to identify my Attack Vector 


options. 


The door was solid wood. The frame was solid metal. So if worse came to 
worst, we would probably need a lot more than a swift kick to open it. Also, it 
was a push door with a commercial-grade keyway, a handle (not a circular 
knob), and no deadbolt, and under the door there was a gap big enough to 
drive a Matchbox car through. I knew, without doing a full perimeter check, 
there was only one way in and only one way out of the office. The office had 
four walls, no windows to the outside, no other interior doors, a floor, and a 


hard ceiling (there were no roof tiles we could move to climb through). 


Pro Tip: A very important part of your skill set is knowing when not to waste 
your time lock picking. A beginner’s rule of thumb is, “Keyways with an extra 
squiggly, zig-zag keyway and a specialty name-brand or icon stamp on the face 
indicates your pocket pick-set is probably not going to work.” Especially if all 
you have in your First-Line Gear are your small tools. Some people can pick 
open these medium- and high-grade security keyways with the right gear and 
a lot of experience. I’m not saying it’s impossible but | am saying you should 
be aware of the limits of your skill set. 


My two primary options were (1) to attack the keyway and (2) to attack the 
latch. I had tools for those options with me, and I had additional tools if I 
needed them in my Second-Line Gear in my vehicle. But there was a third 


option too. 


STEP 4: MANUAL UNLOCK CHECK 


I went ahead with what should almost always be the first physical act in your 
on-scene Target Assessment: Manually try the doorknob or door handle, take a 
deep breath, and try again. (I keep repeating this for a reason! If you are sick of 
it, that’s a good sign. It should be working its way into your head 


permanently.) 


Pro Tip: It might be insulting to a client but go ahead and double-check all 
locked options to confirm they’re actually locked. And try again to open them, 
harder. If you’re teaching others, remind them it shouldn’t be taken as an 
insult that you check their work, but it should be taken as an insult that you 
not reassess their progress. (This is a common phenomenon in law 
enforcement and the military: “Bro! Why are you searching that suspect for 
weapons again? | already searched him!” is something I’ve heard often in my 
career. In response, I’ve had to instruct a colleague, or actually reinstruct 
them since it’s commonly taught in the police academy, “If | handed you a 
suspect and you didn’t search him, | would be offended. It’s a compliment.”) 


STEP 5 AND STEP 6: TOOL AVAILABILITY AND 
“NOW OR LATER” 


I had my First-Line Gear on me, so I took out my Sparrows rake and tension 
wrench. Since I had the time, I figured I'd try to make progress within the 
commercial lock’s keyway. I drew a Line in the Sand: I wouldn't spend any 
more than four or five minutes trying to pick it open. I already knew what my 


second and maybe third Attack Vector options would be. 


I chatted with the lieutenant and the sergeant while I tried raking and picking. 
I explained a little how pin tumblers work and answered some of their 
questions about how lock picking in general works. This is me in my element. 


I could not have been happier! 


The common usage of the phrase “lock picking” can mean many things. As a 
day one lock-picking student, it usually means one of two things by either 
picking open the lock with a raking technique or picking open the lock using a 
Single Pin Picking technique. For this keyway, I quickly switched from raking to 
Single Pin Picking since raking is most effective with low-quality locks. At the 
time I'd started practicing SPP more and could tell I wasn’t making much 


progress. (Another example of skill set shaping in action.) 


Pro Tip: Something I’ve added to the Tactical Lock Picking curriculum is the 
Line in the Sand “tool.” Once you place your Target Assessment on pause and 
begin your entry attempt with a specific Attack Vector, you should start a 
timer (if not a physical timer, at least a mental one) for how long you will 
continue before stepping back and considering other options. This prevents 
the all-too-common “Just give me another minute,” which turns into 30 
minutes or more. (You may have noticed in the case study “Suicide by Pills” 
where | didn’t do this and it bit me. You now are seeing documentation of 
curriculum shaping in action.) 


After about three or four minutes of both raking and SPP, I realized I didn’t 
have the right tools on hand to be able to pick open the keyway. I had hit my 
limit—my Line in the Sand—for this particular Attack Vector. 


STEP 7: OTHER RESOURCES 


The next few things I did were effective only because I was familiar with the 
make/model of the lock. Leveraging information from one lock to a similar 
one is a TLP guideline I call Same Lock, Same Key. (We'll dig deeper 


into this subject in “Guideline: Same Lock, Same Key.”) 


I removed my rake and tension wrench from the keyway and stowed them 
back in my wallet. I plotted my next move by walking 10 feet down the hall to 
the sergeant’s office, which had the same exact door, handle, hinges, and 
keyway, though a different bitting, the profile that the key is cut to. I'd 
considered sliding a commercial shim through the doorframe as my second 
attack option, to slip the latch of the lieutenant’s door, but with the door 
closed I’d been unable to see the latch. I’d also been unable to see whether the 
latch had a dead-latch mechanism and, if so, whether it was installed 


correctly. 


Because the sergeant had given me the key to his office, I was able to go inside 
and shut the door. From the pull side of the door I could see there was a dead- 
latch mechanism, and unfortunately for me (and the lieutenant), it was 
installed correctly, which meant the lieutenant’s was probably installed 
correctly too. That eliminated the possibility of using a shim on the latch since 
the purpose of a dead-latch mechanism (when installed correctly) is to prevent 


the latch from being manipulated. 


At that time, I’'d recently become aware of the under-door tool (UDT) but 
hadn't yet been able to add it to my gear. I checked the sergeant’s unlocked 


door to see whether a UDT attack would even work since it required a specific 


type of locking action. It didn’t work on dead handles, only on alive 
handles. 


Defined: Dead Handle: |lmagine you’re in a bathroom in 
someone’s home and the bathroom door has a handle 
instead of a knob. You shut the door behind you and 
activate the twist-lock to secure the door handle. Once 
you’re ready to leave you turn the handle without thinking 
but the handle doesn’t budge. When you have to manually 
disengage a lock to get a door handle to turn, it’s a dead 
handle: one that doesn’t move unless manually unlocked. 


Alive Handle: This type of handle is commonly found on 
hotel room doors. If you’re inside a hotel room, even if you 
lock the deadbolt, usually all you have to do when you 
want to leave is turn the door handle and the locks and the 
latches automatically retract so you can pull the door 
open. This is an alive handle, meaning that even when a 
door is locked, the act of turning the handle from the 
inside will automatically unlock it. 


I did not yet own a professional UDT, but I did have another long, bendy 
reach tool: A vehicle-opening device known as the Gold Finger tool. (Man, 
what a cool name for a long rod used to penetrate things!) I also had some 


string in the form of the shoelace of a tennis shoe. 


I grabbed the Gold Finger tool and a tennis shoe from the trunk of my car and 
walked back into the building and down the hallway toward the lieutenant’s 
office. I like to think ’'m usually pretty humble, but between you and me it felt 
pretty freaking cool showing up with those things in hand. I was thinking, “If 


this works, it’s going to look pretty awesome.” Right on cue the lieutenant 


grinned and said, “How the hell are you going to open my door with a shoe 


and a fishing pole?” 


Outside (above) and inside (below) views of the sergeants door, which was similar to the lieutenant’. 


The Gold Finger tool (a type of vehicle “reach tool”). 


Gold Finger tool and shoelace maneuvered to the necessary height (checked from the outside of the door). 


Leaning on the Same Lock, Same Key principle—recognizing patterns from 
similar makes/models—I was able to bend my Gold Finger tool to the 
necessary shape and length, tie the shoelace to the top end of the J-shaped tool, 
and do a practice run on the unlocked door to the sergeant’s office. Since the 
door was unlocked, I was able to watch myself attempt the technique from 
either side of the door. This confirmed the office door handle was an alive 
handle: one that would automatically unlock the door if the handle was 


turned. 


Having good intel from a similar lock and feeling very excited to use a 
makeshift tool, I knelt down, slid the J-shaped metal rod under the lieutenant’s 
door, tilted it up toward the handle on the far side, looped the tennis shoe 


string around the handle, and with the pull of the string, the handle turned 
and the latch receded into the open position. Holding the J-shaped tool steady 
with my right hand and applying just enough tension on the shoestring with 
my left while using my third eye (located in the forehead area, for the 


uninitiated), I leaned forward into the door, and viola. 


An under-door tool at work (view from the far side, or locked side, of the door). 


From sliding my makeshift tool under the door to opening the door took 


about 10 seconds. Entry complete. 


A bonus ROI to having this skill set is gaining social capital, or social status, in 
the workplace, i.e., gratitude and respect from peers and employers. If you are 


a “useful human” (a term I heard from a good friend of mine and have started 


using), it becomes a little more difficult to fire or demote you. It also becomes 


easier for people to want to give back to you. 


LESSONS LEARNED 


I later spent time learning which types of commercial locks, whether 
pin tumbler or otherwise, are a higher level of security and how to 
identify them. I added what I learned to my mental file (and to my 
TLP curriculum) on which locks to not waste time picking right off 


the bat, especially with small low- to medium-security tools. 


I added a reminder to my Target Assessment file to keep my eyes— 
and my mind—open for tools I could makeshift out of my 


environment. 


If there are similar make/model doors, locks, etc., that are in our 
environment or that we remember, we can use that to our advantage: 


the Same Lock, Same Key guideline. 


I went ahead and clicked the “Buy” button for a professional UDT. It 


has been my absolute number-one favorite entry tool ever since. 


Under a different LoU, especially now that I carry a professional UDT, 
I might have skipped all the raking and picking and started by 
attempting a UDT attack. I spent about four to five minutes 
raking/picking and then about two minutes bending a makeshift tool 
and an additional 10 seconds to make a successful entry. If I'd 
approach that same door today, especially with a professional UDT, it 
would be a different entry for sure, maybe taking 60 seconds total, 


including the walk to my vehicle trunk and back. 


TLP is a game of percentages. Even at a low level of practice you 


should have a fundamental, well-rounded skill set and be able to assess 


multiple Attack Vectors for many different locked obstacles. Increasing 
your skill level (especially for pin picking) will increase the likelihood 


you ll be able to access a locked obstacle. 


CHAPTER 8 
GUIDELINE: “SAME LOCK, 
SAME KEY” 


PATTERNS EXPLO/TED 


«<* =¥ 


Seven padlocks of the same make/model (with some slight variances) that can all be opened with just two keys. 


The most common application of this guideline is knowing that if youve picked 


open a specific make/model of a lock, then you're more than likely to be able to pick 
open other locks of the same make/model. If you've picked a make/model of a 
lock with a specific set of tools, then picking a lock of the same make/model 
using the same tools has a good chance of success. An exception involves 
bitting, which is the different heights that a key is cut to or that the pins 
within the lock are set to. Some bitting patterns are easier to pick than others, 
and at times you may need different variations of picks to open two identical 


locks with different bittings. 


You can apply the Same Lock, Same Key guideline during your Target 
Assessment. Knowing that you can likely pick open a specific lock with specific 
tools in a certain amount of time will help you get really good at working 
through your decision-making during your Target Assessment, specifically how 
much time and effort to allot for a particular entry. (Same Lock, Same Key ties 


right into your Line in the Sand.) 


Tf one key, code, or password works in a locked obstacle, it might also work in others 
in the same environment. Often the same exact key is used for both the top and 
the bottom locks of a door (the deadbolt and the doorknob). Sometimes the 
same key will get you in a side or back door to a house. Often the same 
key/code/password will get you through multiple locked obstacles in a large 
building; large facilities often key a large percentage of doors to a Keyed Alike 
system so that staff can access multiple secure areas within a facility. ’ve heard 
about gigantic agencies keying all their office suites the same in an entire city 
or an entire state; if one key goes missing (or is stolen) from one branch, then 
every single branch in a city or state is compromised. I teach an entire block of 
instruction on a lock that’s utilized by an international package-delivery 
agency. The agency has 25,000 lock boxes throughout the US that use the 
exact same make/model of lock and the exact same push-button combo for 
every single lock box. You may have heard of fleet vehicles, i.e., vehicles that 


are often purchased or outfitted to be keyed-alike. The phenomenon is not 


uncommon. As you will read in a vehicle-entry case study later in this book 
(“Vehicle Case Study 2: “Yeah, but Why?’”), sometimes even a similar key with a 
slightly different bitting will often work well enough to get the job done. 


Many combination locks leave the factory with the same preset code, or a 
manufacturer default code that is programmed into every lock. It is then up to 
the user to change the code. At this point, you may not be shocked to learn 
that even weapons, narcotics, and evidence rooms are secured behind a simple 


mechanical combination lock that still uses the manufacturer default code. 


We can see that locks often speak to each other, or better yet, they have a 


relationship to one another that can speak to you if you listen. 


How else can Same Lock, Same Key be applied within a building or facility? 
Well, construction companies don’t often say, “Let’s buy a bunch of 
mismatching doors and their associated mismatching hardware. We'll then 
spend time and money custom fitting each type of door with a different type of 
lock and hardware.” That tells us that we can learn from a nearby identical or 
almost identical accessible lock the ins and outs of a lock we can’t access. (See 
the case study “The Lieutenant’s Office.”) This is particularly valuable for an 
under-door tool attack. It’s also valuable for determining whether a dead latch 
is installed and, if so, whether it’s installed properly, as well as whether the far 


side of a door handle is an alive handle or a dead handle. 


Some specialized techniques that work on one lock will work on similar locks of 
different makes and models. Sometimes. Sometimes this works because of 
“clone” locks, where companies copy the exact same construction of another 
company’s lock but slap on a different name brand (or no-name brand). 
Sometimes it works because the construction is similar enough. And 
sometimes it works because of dumb luck. But be aware that sometimes it 


doesn’t work at all (as you will see in the case study “Alarm Call Failure”). 


CONCLUSION 


Be aware of exceptions to the Same Lock, Same Key guideline, as for all the 
guidelines in this book. They might not always be 100 percent effective. 
Tactical Lock Picking and its application are a percentage game: How low you 
can keep your expenditure of time, money, and effort, and how high you can 
raise your likelihood of a successful entry. Just as “Security is a balancing act 
between effectiveness and efficiency,” we are constantly weighing our entry 


approach against effectiveness and efficiency. 


CHAPTER 9 
CASE STUDY: CLOSED PARK 


HE WASN’T A KNOWN AXE 
MURDERER 


The vehicle gate in this case study. 


“Two-Norah-Eleven.” Through the radio I heard a deputy calling dispatch. 
Dispatch responded, “Go ahead, Two-Norah-Eleven.” 


“Dispatch, this is Two-Norah-Eleven. I just got a phone call from my wife, 
who says she’s watching our home security system on her phone and sees 


people snooping around in our backyard. Can you send a unit, please?” 


I didn’t give dispatch a chance to respond. Instead I responded directly to the 
2N11 unit, “Two-Norah-Eleven, this is Three-William-Sixty-One, break. 
Dispatch, clear me from this traffic stop with a verbal and show me 51.” I 
tossed the license of the driver I'd stopped into the car’s open window and 
walked back to my cruiser. I then proceeded berries and cherries (lights and 
sirens) westbound to save the day. A real crime with an actual victim! 


Something we don’t see very often in police work. 


Pro Tip: | was active in law enforcement during the close of the big-brand 
home security system age and the beginning of the DIY internet-based, user- 
operated security system age. A problem we commonly dealt with was 
speeding to calls of burglaries in progress, meeting with the homeowner 
outside of their residence, and watching “burglars” live on the homeowner’s 
smart phone. The problem was that sometimes this turned out to be the 
homeowner watching a recorded video of themselves walking around their 
homes. After wasting time and resources, we’d often find smartphone users 
reacting to notifications of past videos. 


Totally unrelated... Two-Norah-Eleven got back on the radio: “Uh, Dispatch, 
this is Two-Norah-Eleven. You can cancel Three-William-Sixty-One. There's 
[chuckle] nobody in my yard.” 


If you are currently using a big-brand home security 
system, I recommend you listen to my podcast, 
Uncensored Tactical Podcast, available on most podcast 
platforms. | cover the topic repeatedly. Most of the public 
doesn’t understand how these security systems work and, 


more important, how they don’t. | also provide insider 
information on how police respond to alarm calls. 


I was immediately transferred from the burglary call: “Three-William-Sixty- 


One, we've cleared you from this 21. Can you be 10-8 for a lockout?” 
“Ten-four, send it.” 


“Can you respond to 2801 Parkway Drive for a vehicle stuck on park grounds? 
The vehicle is locked behind the park’s exit gate.” 


OMG! The tides had turned! What a gift! I...fucking...love...the opportunity 
to use my specialized skill set to help people. I responded, “Three-William- 


Sixty-One, I am 51,” a smile on my face. 


When I turned onto the isolated road leading to the park, I clicked the 97 
button on my laptop. 


Defined: For readers not in law enforcement, all these 
number codes might sound pretty cool, right? Don’t get 
too excited: 97 just means “arrived on scene;” 57, “on the 
way;” 27, “burglary;” and 10-8, “in service.” 


The sun had just gone down over the trees. I saw the park’s welcome sign and a 


chained and locked manual double-swing-arm steel gate with a pair of 


headlights behind it. 


I kept some basic officer safety tactics in mind while I approached the guy 
standing by his trapped car. He turned his palms up, out to the side, and 
shrugged. I smiled and we introduced ourselves. I told him I needed his ID to 
make sure that he wasn’t in a stolen vehicle and that he wasn’t a known axe 
murderer. He handed me a slip of paper and said, “I’m so sorry to bother you 


to have come all the way out here. I didn’t see any signs posted and didn’t hear 


any notifications the park was closing, but when I got back to my car I noticed 
this ticket thing on the windshield.” The slip of paper read: “This park is now 
closed. The owner of this vehicle can retrieve their vehicle at 9:00 a.m. 


tomorrow for a fee of $15 for overnight parking.” 


He said he didn’t feel it was right to have to pay a fee for being trapped inside 
the park when he hadn't been made aware it was closing. I agreed with him 


100 percent. 


A sign was posted that read, “Park grounds open sunrise to sunset,” but it was 
posted on the manual swing-arm entry gate. If you drove into the park while 
the gate was open (the only option), the gate would’ve been secured to the side, 


rendering the posting unreadable. (Great job, government. ..slow clap.) 


After a quick glance at the locked gate, I told him with a straight face, “Well, 
no, youre not going to have to pay that fine, and we'll have this gate open in 
about 30 seconds.” He looked at the gate, then looked at me, a little shocked 
but happy. I then got down to business, and the fun part of what would turn 
out to be this case study. 


Looking from outside the park toward the front entrance, you could see the 
double-swing-arm steel gate, chained and double padlocked. On the right, you 
could see the welcome sign to the park. There was no room to drive around the 


gate (nicely done, for once, designers). 


Pro Tip: Lock-manufacturing companies will sometimes become aware of 
security flaws in their products and will upgrade their lock designs, which the 
hacker community will learn to exploit; repeat. The problem in this cat-and- 
mouse game is that sometimes a lock can be the same make/model but 
manufactured at a different date and the security flaws may have been 
corrected or at least the design fail altered slightly, but you might not be able 
to tell just by looking at the exterior of the lock. For the lock in this case study, 
| was able to open up the park in two to three seconds using a thin metal 
strip. For upgraded versions of the lock you could do the same attack. Ha! 
Classic bureaucracy. 


I decided to add another layer to this case study: A race of sorts with dispatch. 
What happened next took place within 30 seconds. 


On closer inspection of the swing-arm gate, I discovered a daisy chain of security devices (left to right): left 


swing-arm, medium-level security padlock, chain, Master Lock 175 combination padlock, right swing-arm. 


The lock on the left side of the gate was a BEST-brand lock. Definitely more secure than a $10 padlock from 
your local hardware store. I wasnt likely to open it using my wallet-size tools. TBH, at this point in my career 
there was so much I could get into with a bypass that I only concerned myself with picking low- to medium- 
security locks through the keyway. 


Luckily the other padlock on the daisy chain was a four-dial combination padlock: A Master Lock 175. I knew 


with the right tool I could open it in two seconds, and I had the tool. (Daisy chaining AND choosing a lock you 
could easily guess the code to or open with a two-second bypass using a 10¢ tool? Another strike for you, 


government.) 


I walked to the trunk of my vehicle. I then called dispatch: “Dispatch, could 


you look up the four- digit code for the combo lock on my current call, please, 
and let me know when you've got it?” (Most local law enforcement and other 
local first-responder agencies have access to almost every gate and access point 
in their jurisdictions.) I grabbed my Second-Line Gear bag out of the trunk, 
closed the trunk, and placed the bag on top (see photo, above). 


Sometimes having more locks on an obstacle makes it less secure. 


I unzipped the bag and took out a small keychain, which had a two-inch-long, 
thin, flexible metal strip (shown lying horizontally in the photo above. The two 
tools on the keyring look very similar but they are very different thicknesses 
rendering each unusable for the intended purpose of the other). I walked over 
to the gate, held the Master Lock 175 in my left hand, and with my right I slid 
the metal strip into the top-left corner of the third combo wheel to the right. | 
squeezed the shackle shut, applied downward pressure using the tool, released 


the shackle, and the lock popped open. 


Having made good on my 30-second promise, I walked each of the swing arms 
of the gate to the open position, shook the driver’s hand, and told him he 
could keep the “ticket” and frame it or throw it away. He happily got in his car 


and drove away. I walked each of the gate arms shut, relocked the chain, and 
sat in my cruiser with the A/C on full blast. Even with the sun down it was still 


hot AF in Florida. 


I typed notes about the call into my dispatch program. I then proceeded to 
type up the case study for my running “lock picking in the field” log and 
waited to hear back from dispatch with the code to the gate. 


The radio piped up: “Three-William-Sixty-One?” I responded. Dispatch 
continued, “We have that gate code for you.” I looked up at the welcome sign 
to the park that read, “Welcome! To the park, 2801 Parkway Drive.” Dispatch 
ever so slowly relayed the four-digit code, “It’s two...eight...zero...one,” while 
my eyes scanned that same number, 2801, posted on the sign in eight-inch- 


high letters. (Three strikes, government! You're out!) 


TECHNIQUE IN ACTION 


Lf this copper-colored plate in the Master 175 padlock is lifted like pictured above (top) plate at rest, (bottom) 
plate being lifted, then the shackle is able to be released/unlocked. 


This Master 175 bypass can sometimes be executed by a barrette (like the ones I keep in my First-Line Gear and 
Second-Line Gear). The barrette is inserted into the top left of the third dial to the right on the lock’ dial face. 
Its almost fully in position above; it has to be just under the copper pink-colored triangular plate to lift the 

plate. Once the barrette is pushed in another fraction of an inch it can be manipulated to lift the plate, 


unlocking the lock. 


LESSONS LEARNED 


Keep in mind that if you ever see a mechanical dial-combination lock, 
you can always do a “brute force” attack (no, not hitting it with a 
hammer, though that sometimes works too). I refer to this as the Plus- 
One Method, which highlights that it is so easy, a child could do it. 
Set the dials to 0-0-0-0, and just add one: 0-0-0-1. Then add one 
again: 0-0-0-2. If you'll be trapped overnight for eight hours, you 


might as well give it a shot. 


The next chapter in this book, “Guideline: Four-Digit Codes,” will 
take you on a deep dive into attacking the combination of a lock or a 
keypad instead of the actual physical obstacle. This will raise your 


Target Assessment to a whole new level and help shape your skill set. 


If the guy in this case study had a soda can and a smartphone, he 
could’ve searched the internet for the make/model of the lock and 
figured out how to create a metal shim tool to pop it open. This skill 
set is certainly unique, but there’s much about it that doesn’t require 


years and years of practice. Just thinking like a crazy person helps. 


Sometimes more locks doesn’t mean more secure, and sometimes it 


does. Stay curious and try to figure out when those times are. 


There wasn't a lot of emphasis on the Target Assessment steps in this 
case study. For the Tactical Lock Picking practitioner, knowing 

whether you have a shim tool with you and knowing when a clearly 
shimmable lock is present gives you an almost 99 percent chance of 


making a quick and painless entry. I’m not a slave driver and I don't 


believe in busywork. Don’t go through steps just for the sake of going 
through steps. 


¢ There isn’t a ton to learn from this case study. We learn much more 
when we have failures or at least partial failures, which this book is 
mostly made up of—for a reason. Let your environment speak to you. 
When things go wrong you have a chance to improve your skill set. 


Search for answers and upgrades instead of excuses. 


CHAPTER 10 
GUIDELINE: FOUR-DIGIT 
CODES 


YOU ALREADY KNOW MORE THAN 
YOU KNOW 


A secure door in a secure facility (photo provided by a former student). 


We're not supplying any background here. We're throwing you right into the 
field of operation. You just fucking flat out walked up to this thing. What do 


you think the code is? Please enjoy your first math-heavy exercise. 


FOUR-DIGIT EXERCISE 1 


Task 1: List your first three guesses. (Assuming you already have your 
Moral Right for Entry and your Speed/Level of Urgency.) 


Answers: 
First guess: 


Second guess: 


Third guess: _ 


Let’s say this wasn’t successful. Consider how else would you attempt to break 


the code. (We will focus later on the physical attack of a locked obstacle.) 


Task 2: Note the four worn-down digits on the keypad. Parameters: If each is 
tapped only once, and it’s a four-digit code, use your brain (not the internet, 
yet) to figure out the total number of possible codes utilizing these 


parameters. 


Answer: 


If you can’t figure out the math or if you read on and find out your guess is 
wrong, take it upon yourself to search the internet for how basic statistics 


work. 


Here’s the math: If we have four numbers to choose from and if each number 
is used only once and if it’s a four-digit code, we have 24 options. We won't go 
crazy-deep into the math, but for this scenario it’s 4 x 3 x 2 x 1. Let me explain 


why. 


Because it’s a four-digit code, the equation is_x __x _x_= 


The first digit (the first blank space in the equation) represents a choice from 


four separate numbers, or inputs: 4x x _x_=_ 


Now that one of the inputs has been selected, there are three available choices 


for the second input: 4x 3x_x_=_ 


For our third choice, we can choose from only two remaining inputs: 4 x 3 x 2 


xX = 


Finally, we have one input left: 4x 3x 2x 1 = 24 


Task 3: If we're pretty damn sure the keypad has a four-digit code and that 
only the four worn-down digits are used and that each is used only once, is it 
so hard to try out 24 guesses for a likely successful entry? Is that a good use of 


our time? If it were me in the field, the answer would be yes. 


Let’s create the list we would use in the field for this specific obstacle. You start: 
Using the parameters provided above, list all 24 possibilities for this 
combo lock. (You can check your guesses on page 114.) 


Pro Tip: Becoming familiar with the listing-tree format shown here can really 
help you in the field, for example, by reducing a two- to three-hour entry to 
an hour-or-less entry. If you have an internet connection, you can plug many 
of these variables into online programs that will calculate results for you 
automatically. 


Under most circumstances in the field, it’s completely reasonable to do the 
math to determine 24 likely combos and to try them all. That said, I would 
tend to investigate other feasible entry techniques. But for training purposes, 


let’s continue with our code breaking. 


Task 4: Next, you'll want to check for a master code or a factory default code 


(ignoring for the moment the worn-down digits). First, enter search terms on 


the internet to find out the make and model of the lock. 


Answer: Make and Model (or just the series type) 


Some locks have their make and model numbers printed on them and some 
dont. For the lock in this scenario, I used the search terms Digital Keypad Door 
Lock Handle 1-9 * A. 1 got this answer: DL2700 Series Trilogy Lock. 


Task 5: In an internet search bar, type the series number and lock 
name along with the term installation manual, then look for 
manufacturer default code and/or master code. For extra credit, find 


the manufacturer's recommended new master code. 


The DL2700 Series lock installation manual I located listed the default code 
and the master code as the same, then listed a recommended, updated master 
code. (If you’re unable to find an installation manual for the lock, here is a 
direct address to an online PDF file: https://nkssolutions.co.uk/wp- 
content/uploads/2017/04/DL2700_programming.pdf.) 


To quote directly from the manual: “The factory-programmed code is 


, but this code must be changed as follows to preserve security. For 


» 


example, change the factory-programmed Master Code to _ 


The manual for this DL2700 series lock states that you can set the master code, 
and the standard entry codes as well, to anywhere from three to five digits. 


Lesson: The rule of thumb for most mechanical push-button locks and most 
digital keypads is to start with a four-digit code since it’s the most common. 
Doing some research and using context clues you can go from there to figure 
out if the code is three digits, five or six digits, the odd “three numbers and 
then the star key,” or something else. 


Answer: For this lock, the manual gives the factory-programmed code as (hold 
your breath, this is going to be shocking) 1-2-3-4-5. Then it recommends the 
new master code: 5-4-3-2-1. I wonder if the design team for this lock was 


comprised of former military officers. 
1. 1-3-7-9 
2. 1-3-9-7 
3, 1-7-3-9 
4. 1-7-9-3 
5. 1-9-3-7 
6. 1-9-7-3 
7.34275) 
5351-57 
9. 3-7-1-9 
10. 3-7-9-1 
3947 


12. 3-9-7-1 


13. 7-1-3-9 
14. 7-1-9-3 
15. 7-3-1-9 
16. 7-3-9-1 
17, 7-9-1-3 
18. 7-9-3-1 
19. 9-1-3-7 
20. 9-1-7-3 
21, 9-3-1-7 
22, 9-3-7-1 
23. 9-7-1-3 
24. 9-7-3-1 


Task 6: This setup is certainly not high security. We almost definitely would 
have defeated the lock with these options, but assuming a failure of all our 
attempts so far, list three physical entry techniques we could try on 


the locked door in this scenario. 


It’s important to carry First-Line Gear. It’s also important to know the distance 
to your Second-Line Gear and Third-Line Gear. Knowing this will help tell 

you determine whether it’s worth retrieving your Second-Line tools for a more 
likely entry or whether to stick it out and try your First-Line options for better 


time management. 


Tera guesses 


The initial message from my student concerning this lock he had to access. 


With your First-, Second-, and Third-Line Gear at your feet, you could grab a 
commercial shim first, since it is easily accessible and doesn’t require a lot 


of setup to see if it’s able to slide into the door jamb easily and access the latch. 


If it’s not able to access the latch or the latch isn’t budging, you can quickly 


switch to your under-door tool. If the door handle is a dead handle or if 
there are bags or boxes in the way on the far side of the door and your UDT 


isn't working, you can try to rake or pick the keyway open. 


This chapter is heavy on codes, but always be on the lookout for a quick 
bypass. 


If you didn’t guess the code in your first attempt, don’t feel bad. I was sent this 


scenario from a former student, and it took me a few guesses too (I’m the blue 
text). The good news is that as soon as I saw the correct code, some 
information stored in my head jarred loose. Many keycodes I’ve documented, 
even when the numbers appear random on the keypad, seem to fall into a 
pattern, which is that most people choose digits in an increasing number value. 
People more commonly choose 1-3-7-9 than 9-7-3-1, most likely because as 
toddlers, they started learning number skills by counting up, not down. Ina 
pinch, when I see rubbed-off or worn-down digits, I start counting from low 


number values to high number values. 


Pro Tip: Usually the number that is the most rubbed off on a keypad is the 
first number that people touch with their greasy fingers. The number rubbed 
off the least is often the number they touch last, since most of the grease 
stays on the first and second inputs and a little on the third. 


FOUR-DIGIT EXERCISE 2 
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An easily identifiable padlock on a fenced gate, referenced in this exercise. 


A friend of yours owns a small business he started in 1992. (You always see 
him wearing his “Est. 1992” shirt.) He’s got a commercial on local TV with 
the catchy jingle “Installations for you since 1992, call 555-7772.” The 
business is located at 5124 Commercial Avenue. There’s a fenced-in lot in the 


back with supplies and materials stored inside the fence line. 


Your friend has to take an emergency flight out of state. He asks you to drive 


to his business, use the code wah-wah-wah-wahhh (which you can’t remember) 


to open the lock on the gate and move all the supplies to a covered area to 
avoid any possible water damage. He’s currently on a five-hour flight and you 


cant get hold of him as you stand at the gate and stare at the four-digit combo 
lock. 


Scenario A: If you tilt up the lock and see what is shown in the photo, above, 


what would be a reasonable first guess for the correct four-digit code? 


Answer: 


Scenario B: If you see this when you tilt up the lock, what would be a 


reasonable first guess for the correct combo? 


Answer: 


Scenario C: If you see this setup, what would your guess be? 


Answer: 


If you're completely lost, that’s okay. Go back and read the introductory 
paragraph for “Four-Digit Exercise 2.” See if anything stands out, then take a 


look at the numbers displayed in the different scenarios. 


If you are still lost, here is your hint: The introductory paragraph tells us that 
the store owner established his business in 1992 and never shuts up about it. In 
scenario A we see that the dials of the combo lock are currently set to 1-9-8-1. 
This is really close to 1-9-9-2, a number that means a lot to your friend and his 


business. If you're still lost, the combo is 1-9-9-2 for scenario A. 


In scenarios B and C, you see that the combos are set to a/most the numbers 

that mean something to your friend and his business: The phone number and 
street address. When the factor of laziness comes into play (sorry, efficiency”), 
most people don’ shift the dials all around on combo locks like this one. They 


adjust only one or two dials to one or two numbers up or down. 


Most people also pick numbers that are significant to them and are easy to 
remember and to relay to other people: “Just remember, it’s the same as the last 
four digits of my phone number.” It’s fucking wildly common that when 
homeowners give out-of-town guests their garage door code they say, “If we're 
not home by the time you get there, our garage door keypad code is ‘six, seven, 
two, one.’ If you forget, just remember it’s the same as our address, 6721 Elm 


Street.” 


FOUR-DIGIT EXERCISE 3 


A key storage box hanging from a residential doorknob, referenced in this exercise. 


You're new to a realty company, and your boss escorts you to a house listed by 
the company and gives you a tour. When you leave the property, your boss 
puts the house key into a key box. You watch as they dial the fourth dial on the 
right up several digits but don't touch the first, second, or third dials at all. 


Back at the office, your boss tells you they’re heading home and you should 
stay for another hour or so in case people walk in who want to visit the listing 


youve just toured. Perfect timing! Just after your boss leaves, a couple walks in, 


and they want to view the house. You call your boss on the cell and your boss 
reminds you about the four-digit code to the key box, but youre nervous and 
excited and you don’t write it down. You think to yourself, like several million 
people on this planet do every day, “It’s just four numbers, I can remember it,” 


but when you arrive at the lock, your brain is a complete blank. 


Do you have permission to enter? Yes. What is the urgency? Well, if you don't 
get in the house, youre not likely to impress your potential buyers and will 
probably lose out on a big sale. So this is not the “Right Fucking Now” 
Speed/Level of Urgency but still merits “The Quicker the Better” level. 


Standing at the front doorstep, locked out, you call your boss to get the four- 
digit code to the lock box but your boss doesn’t pick up. 


How would you mount your attack on the key box? How many possible tries 
would it take for you to guess the correct combo on the lock, knowing there 


are 10,000 possible entry codes? 


Question: What is the maximum number of attempts before 
successfully gaining access if you know the first three of the four 


combo dials are unchanged? 


Answer: 


If you know the first three dials of the combo lock are all correct, you only 


have to try the last dial (0-9), for a maximum 10 attempts. That should take 
you about 10 to 20 seconds. 


Lesson: This mental “tool” is useful if, during a decoding attack, you’ve 
decoded three out of the four digits of a four-digit lock but you’re stressed 
and stuck on the fourth number. Stop “decoding” and try the correct three 
dials with each possible digit on the fourth dial, for a maximum 10 attempts. 
Sometimes, under stress, people will think, “Oh no! I’ve forgotten the last 
digit for this combination. I’ll never get in!” And they give up when they only 
had to try x-x-x-1, x-x-x-2, x-x-x-3, up to x-x-x-0. 


FOUR-DIGIT EXERCISE 4 


A pistol lock-box “hidden” under the bed, referenced in this exercise. 


children in your home. 


So easy a competent 10-year-old could do it. 


You go online and purchase a lock box for your home defense pistol since you 
don’t want the child in the house to have access to it. You settle on one that has 
a code with three digits (meaning at least several hundred possible 
combinations) because you don’t want to have to go looking for the key when 


an intruder is kicking in your front door. 


You make clear to your 10-year-old that he should never touch the box or look 


inside. So...what does he want to do? He wants to find the box in its top- 


secret hiding place under your bed and look inside. But it’s locked, right? So 


that means he could never get in there... 


One day you yell at him for doing some stupid thing kids do (which is 
basically their job), and you leave him alone at home for 30 minutes because 
you have to go do an adult thing outside the home. Your child (doing what 
kids do) wants to rebel. He sits down with the box and sets all three dials to 
zero. He dials 0-0-1 and tries the lock, dials 0-0-2 and tries the lock, then 0-0- 
3, 0-0-4...and what happens? Does it take a genius to figure it out? 


Well, here’s the sad answer. A 10-year-old who knows how to count can open 


any three-digit dial combination lock in fewer than 15 minutes. 


The moral of this story is that you don’t need a master’s degree in “security 
theatre” to locate the flaws in most security systems. Some attacks, and some 
defenses, do require a bit of research, but the information isn’t proprietary, 
meaning it’s not secret or classified. Use that big, sexy noodle of yours and 


think through a security setup as if trying to defeat your own security. 


RULES FOR FOUR-DIG/T LOCKS 


Examples of common, inexpensive four-digit combo locks. 


Because there are four dials in a four-digit combination lock, and each dial 
goes from 0 to 9, if you start at 0 (0-0-0-0) and count up to 9,999 (9-9-9-9), 


that means 10,000 possible combinations. 


The rules, and the math, are simple. It is a four-digit code, so the equation is _ 
x __x__x_ =_. (Four options multiplied together.) 

Each dial could be 0-9, or 10 possible options. 

The first dial, then, could be any of 10 options: 10 x __ x _x_ = 


Since we can repeat digits, the second dial could also be any of 10 options: 10 


xlOx_x_=_ 


Same with the third dial: 10x 10x10x_ =_ 
And with the fourth dial as well: 10 x 10 x 10 x 10 = 10,000. 


Doing the math here is unnecessary because, again, you could just count. But 
it’s a good start to understanding that using equations, you can figure out the 


number of possible options for many different lock setups. 


RULES FOR FIVE-DIG/T VEHICLE KEYPADS 


A type of push-button keypad commonly seen on vehicles. 


Many vehicle keypads use five-digit codes. For example, 1-3-5-7-9 could be the 


installed code. Also, numbers can repeat, meaning someone could program 3- 


3-5-3-5 as an unlock code. Additionally, the order matters, meaning that if 1- 
3-5-7-9 is the correct code, then 9-7-5-3-1 will not open the lock. 


The equation works out to be 5x 5.x 5x5 x5 = 3,125 possible options. 


When each input button on the keypad has two different printed numbers (see 
photo, above), don’t focus on the numbers but on the input button itself. Say 
the entry code is 1-3-5-7-9 and you push the inputs with the intention of 
entering 2-4-6-8-0; you've still pushed the same inputs in the same order. If in 
the field you're getting confused by the math because of what’s printed on the 
input buttons, you can also try renaming them. For example, renaming button 
1-2 “Button A” and button 3-4 “Button B,” etc., might help lessen your 


confusion. 


RULES FOR A SPECIFIC FOUR-DIG/T, TEN-INPUT 
LOCK 


The key storage box referenced here. 


This is a little more advanced, so if you like, after learning the “rules” of this 
lock, consider trying to work out the math on your own. ‘Then if you want to 
check your answer or if you think you'll get as much value out of research via 


the internet, go for it. 


For this setup, the combination has four digits and 10 different inputs from 
which to choose. You cannot repeat numbers but the order in which you press 
the input buttons does not matter, just as long as all the correct inputs are 


selected as a group. 


For example: I could not set the entry code as 1-1-2-3 because you cannot use 


any input twice. I could set the code as 1-2-3-4 (and many, many people do, 


up to and including triple-secure military facilities...ask me how I know). 
Now with 1-2-3-4 as the entry code, for this particular lock and some like it, 
the code 4-3-2-1 will also open the lock since the order in which you press the 


selected inputs does not matter. 


For your homework, if you like, try to determine the number of possible entry 


codes from which you could choose. 
Now for the math. 


The equation we start with is_ x __x _x_= 


For the first selection you can choose from any of 10 available inputs. That 


brings the equation to: 10x _x_x_=_ 


For the second selection, you can choose from only nine available inputs since 
one input is already selected and you cannot repeat inputs. That brings us to: 
10x9x_x_= 


For the third input, you can choose from only eight of the remaining inputs: 


10x9x8x_=_ 
The fourth input brings us to: 10 x 9 x 8x 7 = 5,040. 


But now we have a problem, because many of those 5,040 possible input codes 
don’t have repeated numbers (remember our decreasing input availability: 10, 
9, 8, 7), but many do have all four of the same input numbers but in different 
sequences. If we set 1-2-3-4 as the code for this lock, the list of 5,040 possible 
solutions from our equation would list several different sequences of the 
numbers 1, 2, 3, and 4. We would come across 1-2-3-4, 1-2-4-3, and 1-3-2-4, 


etc. And any arrangement of those four digits selected as a group would access 


the lock. 


How many possible ways can you arrange a four-digit string of numbers using 
all four numbers (1, 2, 3, 4) and only those four numbers but in different 
sequences? See “Four-Digit Exercise 1” if you need help, but the answer is that 
you can arrange the numbers 1, 2, 3, 4 in 24 possible sequences if you use all 


four inputs, once each. We now divide our answer by 24. 
5,040 divided by 24 brings us to 210. 


This means that for a four-digit, push-button lock where you can choose from 
10 inputs and cannot repeat numbers, you can select only 210 possible 
combinations when setting the code and you need to guess only 210 possible 


combinations when attempting a brute-force, or Plus-One Method, attack. 
Let that sink in. 
Please read this section again if it has not. 


Now let’s raise this lesson to a whole new level. If we had a list of all possible 


210 correct entry codes, how long would it take to try each potential code? 


You can try to work out the math if youd like, but I’m all mathed out right 


now. It’s a very small number. The answer is “under 15 minutes.” 


As for the math, there are some variables to these types of equations when used 
to calculate the number of correct entry codes possible. But just knowing 
there’s a limit to the number of possible guesses can help you in the field to 
determine whether it’s worth using the counting method as a form of an 


attack. 


I refer to this as the Plus-One Method because starting with zero, you add one 
to each number until the lock opens. Some locks with different “rules” might 
complicate things a bit, but at least you now know the input possibilities are 


not infinite. 


Lesson: Where this method shines is with something simple like a three-digit 
dial combo lock, in which each dial is O-9, with 1,000 possible entries. If the 
maximum amount of time it takes to count from 0 to 999 is only about 15 
minutes but going to your vehicle or office or the hardware store for a pair of 
bolt cutters takes about 40 minutes round trip, then knowing the math will 
help you save a shit-ton of precious time. 


THE SIX ATTACK VECTORS 


Currently, I group my four-digit-code training into six different Attack 


Vectors. Let’s cover each in more detail. 


ATTACK VECTOR 71: MANUFACTURER DEFAULT 
CODE (MDC) 


Almost all mechanical locks (push a button or dial in a code to operate a 
mechanical/physical lock system) come with a factory default code preset upon 
purchasing or, if you have to install the lock yourself, a recommended test code 


that after testing youre supposed to change...right. LOL. 


There are also a lot of digital locks (push a button and they beep, mostly) that 


have a factory-installed default code as well as the occasional master code. 


Manufacturers of mechanical and digital locks with factory default codes or 
master codes will often post installation manuals online where you can locate 
those codes. In my courses, I recommend following a specific order to figure 
out the most likely and most efficient entries for four-digit codes. If you don’t 
have a bypass option or a tool on hand for a particular bypass, then this order 
of operations often (but not always) starts with trying to locate a 


manufacturer’s default code. 


Defined: A factory-installed default code for digital locks is the code that will 
open your locked obstacle right out of the box. It is usually alterable and 
manufacturers recommend that you change this code once you install your 
lock and confirm its working condition. A master code for digital locks will 
open the locked obstacle no matter the current set combination. Think of this 
as a “digital back door.” 


ATTACK VECTOR 2: COMMON ACCESS CODES 
(CAC) 


This category includes two different types of common codes. 


CAC GROUP 1: PAPER PATTERNS 


These are strings of four numbers whose pattern becomes clear when you write 


them down or say them aloud. In other words, you will see or hear the pattern. 
Examples: 

¢ 1-2-3-4 (first four possible digits, counting up) 

¢ 4-3-2-1 (first four possible digits, counting down) 

¢ 6-7-8-9 (last four possible digits, counting up) 

¢ 9-8-7-6 (last four possible digits, counting down) 

¢ 2-4-6-8 (even numbers, counting up) 

¢ 1-3-5-7 (odd numbers, counting up) 

¢ 5-5-5-5 (See the pattern?) 


The combination 8-6-7-5-3-0-9 has been reported by several sources as one of 
the most common seven-digit codes to date. It might be worth adding 8-6-7-5, 


or even 5-3-0-9, to your list of common codes to try. 


When you start tracking your own case studies, you'll be able to recognize 


plenty of these poorly planned paper patterns that keep popping up. (Excuse 


the alliteration.) 


Pro Tip: Most people who pick “random” four-digit codes, especially ones that 
change frequently, will often rearrange the order of the digits 1, 2, 3, and 4 
(ask me again how | know). Remember, if that is the case, there are only 24 
different possible combinations for 1, 2, 3, 4 if you use all four inputs, once 
each. 


CAC GROUP 2: GEOGRAPHICAL PATTERNS 


One of the most common geographical codes on a digital keypad 2-5-8-0. 


Think about tracing a “geographical” pattern with your finger on the keypad 
shown in the photo, above (from “Four-Digit Exercise 1”). Disregard the 


numbers for a moment and just look at where your finger might touch. 


Examples: 


¢ 2-5-8-0 (down the middle; one of the top-two most common 
geographical patterns) 


¢ 1-3-7-9 (the four corners of the keypad, tracing a Z pattern or a “box” 


pattern; one of the most Common geographical patterns) 


1-7-3-9 (the four corners of the keypad, tracing a backward-N 
pattern) 


1-4-7-* (down the left side) 


1-4-7-4 (down and back up the left side) 


2-5-2-5 (a common pattern, along with its variants) 


6-9-6-9 (a quite common pattern and, if I might add, a very classy 


one) 


ATTACK VECTOR 3: SOCIALLY ENG/NEERED 
CODES (SEC) 


These are codes that people have chosen for a reason. Usually the reason is that 
it’s easy to remember and to describe to others so they, too, can remember it. 
This is especially true today, when most people must come up with dozens of 
four-digit codes. Raise your hand if you've ever heard someone say something 
like this to you: “When you get to the gate, punch in ‘three, eight, two, four’; 
its the last four digits of our home phone number in case you forget.” 


Examples: 
» birthdays (YYYY, MMYY, DDMM) 
e anniversaries (YYYY, MMYY, DDMM) 
¢ addresses 
¢ phone numbers 


¢ dates (especially those that start with 19) 


People will also choose the letters associated with digits on a keypad for a four- 


digit code so in their head it’s a four-letter code instead of a four-digit code. 
The codes H-E-L-P (4-3-5-7) and E-M-S-* (3-6-7-*), along with their variants, 


are cCOmmon. 


An extremely common Socially Engineered Code, a code that means something to the person or the facility, 4-3- 
5-7 (H-E-L-P on an old telephone keypad.) 


A commonly used code that represents an idea (if not specifically letters) is 9- 
1-1-Enter and variants such as 0-9-1-1, 9-1-1-0, and 9-1-1-*. Especially when 
you see a keypad with the digits 9 and 1 rubbed off from wear, I’d consider 


those codes. 


Many facilities that are known by their acronyms will use the acronym’s 


associated digits on keypads. For example, if you work at the Society for 
Security Research and Associates Inc. (SSRA) and you are locked out but you 
do have a right to make entry, you might want to give 7-7-7-2 a try. 


Imagine you're standing outside a huge facility, Big Butts and Big Boobies 
Limited, and youre responding to an emergency inside but don’t have an easy 
way into BBBB Ltd. Maybe try 2-2-2-2 (2 being the digit associated with the 
letter B on a keypad) or 8-8-8-8 (8 being the digit that looks like the letter B 
on a keypad). Or...for an exercise in stretching that creative-brain muscle of 
yours, can you think of another code or two you might want to try here that 
we've already identified? I'll give you a minute to see if you can figure it out. 
Hint: Think like a teenager. Or more specifically a teenage boy. Answer at the 
end of this chapter. 


ATTACK VECTOR 4: RANDOM ACCESS CODES 
(RAC) 


These are the fucking worst for an attacker. If you want to truly protect your 
property (which we will discuss further in “Guideline: Security Assessments”), 
this is the best category from which to choose codes. These codes are truly 


random. 

Examples: 
e not the manufacturer default 
¢ no paper pattern or geographical pattern on keypad layout 
¢ no associated letters or acronyms 


* not representing an important date 


¢ not representing an address or phone number 
¢ not starting with the digit J (especially 1-9-x-x) 


¢ not comprising the digits J, 2, 3, 4in any order 


ATTACK VECTOR 5: CODE EVIDENCE 


Some keypads and even some mechanical push-button combination locks will show evidence of wear and tear 


on the buttons used most frequently. 


When digits on a keypad are rubbed out, and especially if four separate digits 
are rubbed out, you can narrow down your entries to 24 options. If digits J 


and 9 are severely rubbed out and other digits here and there on the keypad are 


visibly worn, how many possible combinations could there be if you know for 
certain that both / and 9 are used in the combination? Here’s a big hint: If you 
know that J and 9 are severely rubbed out because they're the first two digits, 
how many possible combinations could there be? Pause your reading here and 


consider the number of possible combos if the code were 1-9-x-x or 9-1-x-x. 


For 1-9-x-x, you have to try only 100 possible entries for the last two digits: 0-— 
0 through 9-9. Just count up. 


For 9-1-x-x, you also have 100 options for the last two digits. But the 
likelihood of someone choosing a four-digit code for a reason and then 
choosing a date (a year) would steer me to trying all the 1-9-x-x options before 


the 9-1-x-x ones. 


Other types of code evidence would be that the code is fucking written down 
or posted nearby. We've already come across some examples in this book: 
Addresses posted prominently in front of buildings, phone numbers displayed 
above a keypad entrance to a business, etc. (For extra credit: At what distance 
would a code usually be written down or posted?) Another example: When 
setting the code for a keypad, someone might look around and see a sign 
nearby with four numbers and think, “That'll do.” Yes, this happens in real life. 
Shockingly often. 


You may have noticed overlap here with other sections in this book. In fact, 
youll find overlap in every single chapter. That is a good thing for the entry 


specialist. 


ATTACK VECTOR 6: BRUTE-FORCE ATTACK (PLUS- 
ONE METHOD) 


We covered this in “Four-Digit Exercise 4.” It’s so easy a child could do it. 


What’s probably most important about using a brute-force method (adding 


one value at a time) is knowing how long it will take. 


A standard mechanical four-digit combination lock. 


I don’t want you to be stuck in your vehicle behind a sturdy steel gate 
padlocked with a three- or four-digit combo dial lock and think, “Well, fuck, 
I’m stuck here. There must be thousands of possible codes, and there’s no way 


Pll be able to guess the correct one. I give up.” 


With some simple math, even with rough estimates, you can have a pretty 
good idea of how long it might take you to start with all zeros and work your 


way up. 


If you are looking at a three-digit code and are able to try one guess every 


second, that’s about 60 guesses in one minute, right? Calculate 60 x 2 and you 


get 120. Let’s round that off to 100. You can try 100 combinations in about 


two minutes. 


How many possible codes could a three-digit lock like the one shown in the 


photo, above, have? The answer is exactly 1,000. 


So if we can try roughly 100 guesses every two minutes, how long would it 


take to try 1,000? 
You can try every possible combination in approximately 20 minutes. 
Isn’t knowledge much better than a defeatist attitude? 


Let’s take the math a step further. How many possible entries would there be if 
we added a fourth input? 


You should already know this from “Rules for Four-Digit Codes,” but it’s good 
practice. The answer is 10,000. 


So from our rough estimate for three-digit locks, we know that in about 20 
minutes we can try 1,000 combinations. How long to try 10,000 


combinations? 


We multiply by 10, right? What is 20 minutes times 10? Three hours and 20 


minutes (roughly, if we are attempting one code value every second). 


Now if you are trapped behind a locked obstacle at night and no one is coming 
to rescue you for another eight to 10 hours, you have this beautiful new tool of 
knowing the amount of time it could possibly take you to save yourself. The 
choice is yours: (1) get through the gate in three hours and 20 minutes or less 
or (2) wait another eight to 10 hours for someone to come unlock the gate the 


next morning. 


Pro Tip: There’s a good chance that the correct code for a four-digit combo 
lock is not 9-9-9-9. | like to emphasize “or less” with my math on how long it 
will take to try the Plus-One Method, reminding you that you'll likely have 
that obstacle open sooner! 


CONCLUSION 


In modern social engineering, the goal (roughly) is to get people to do things 
for you. In Tactical Lock Picking we don’t “engineer” people. Instead we use 
the concept to understand how people as social beings, and as creatures of 
habit, operate in order to deconstruct our way into a locked obstacle with 
codes they choose. We engineer (or better yet, de-engineer) the way people 
interact with their security to give us a different perspective on locked 


obstacles, especially coded ones. 


Stay creative. Look for code evidence. Pull up manuals and source documents. 
Lean on the Same Lock, Same Key guideline. Become familiar with some basic 
math to help navigate your timelines. And always be on the lookout for 


additional resources. 


Answer to BBBB Ltd.: 


8-0-0-8 (Boob), and 6-9-6-9 (I'll leave this one up to the reader to decipher) 
are also on several lists for the most commonly used four-digit pin numbers, or 
four-digit codes. While editing this chapter I saw two professional looking 
adults walking into a coffee shop ahead of me and I overheard the female say to 
the male “So you know my friend Jason? He was just telling me that he uses 
the same password on every four-digit pin code he has,” which, of course, 
perked my ears up. She continued right along with giggling and saying, “Get 
this! It’s...6-9-6-9!” I know this is somewhat of an immature take on a very 


serious subject but I promise you this is a real pattern. 


CHAPTER 11 
CASE STUDY: ALARM CALL 


EMBARRASSMENT AND LEARNING 
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A very common four-digit dial combination lock securing a gate, referenced for this case study. 


When I was a patrol officer in local law enforcement, one of my favorite areas 
to police was a large but not too fast-paced two-unit zone. Usually when | 


worked that zone the other “unit” was a super-laid-back and very approachable 


fellow, Deputy T. He was great with verbal judo and could calm down almost 
any angry person we dealt with. Several times when I heard him through the 
radio say he had arrived on scene, I could also hear voices in the background 
screaming at him. But when I arrived as backup, everyone was talking calmly. I 


had a lot of respect for Deputy T. 


He and I both arrived at the same time to a late-night alarm call in our zone. A 
motion-detector alarm had gone off at a large construction site right off of our 
zone’s main drag. We parked in the front parking lot and walked toward a 
small office building. All looked secure so far. We then walked toward the 
office building. Joined to the side of the building was a seven-foot-high gate 
with a padlock. Deputy T was familiar with the owner of the property and had 
been given permission to unlock the gate and enter if the alarm ever went off at 


night. 


Deputy T didn’t remember the lock’s four-digit combo, and I couldn't help 
thinking, “This would be a great open-and-shut case study” (no pun intended). 
“Hey, T, check this out,” I said. 


There is a bypass technique that makes quick work of some combination locks, like the one shown in (1a) and 
(1b). The combo lock on the fence in this case study was the lock shown in (2a) and (2b). Both locks are from 


the same company, both are mechanical four-digit combo locks with the combo wheel on the bottom, and both 


are roughly the same size. They even have the same three digits (1,7,5) in their names (models): Master 175 
and Master M175. Sometimes similar makes/models have enough in common that techniques successful with 


one will be successful with the others as well (Same Lock, Same Key). Sometimes not. 


Weve already seen how this bypass technique works internally on the padlock in the case study “Closed Park.” 
Here’ another view of how the technique is supposed to work: (1) Retrieve or create a small, thin shim tool. (2) 
Insert the shim tool about ¥2 inch to ¥4 inch into the top left corner of the third wheel to the right. (3) Depress 

the shackle and hold it shut, then push down on the free end of the shim tool. (4) While pushing down on the 


shim tool, release the shackle. 


The farthest I could insert the bypass tool into the lock in this case study, the Master M175, was 1/16 inch, no 
matter how hard I pushed or at which angle. 


Knowing there were several makes/models of four-digit combo locks 
susceptible to the padlock bypass technique I used in the case study “Closed 
Park,” I grabbed a barrette from the glovebox of my cruiser. I proceeded to 
show Deputy T how to snap the barrette in half at just the right place to use as 
a bypass tool. 


Holding the combo lock in one hand, with my other hand I tried shoving the 
tool into the slot with more and more force and more and more jiggling—to 


no avail. 


Deputy T, ever the positive type, said with no sarcasm whatsoever, “Hey, man, 


I’m sure that when that works, it’s pretty nifty. I'll just take a stroll around the 
outside perimeter of the fence. If you get the lock open, let me know.” He 


patted me on the shoulder and started off on a walkaround of the fence line. 


We ended up pretty certain there was no mischievous activity, so I really had 
no reason to stay and try to decode that four-digit lock—although if I did, I 
definitely would have started by looking around for big, bold posted four-digit 


numbers (addresses, phone numbers, etc.). 


I cleared the call and moved on with my shift. Once my frustration passed I 
did some research, and it turns out that the internals of the locks in the two 
cases are way different. The bypass technique used on the Master 175 lock in 
the case study “Closed Park” therefore does not work on the make/model lock 
(the Master M175) in this case study. 


Failures are important. They happen frequently. They teach us a lot more than 


our SUCCESSES. 


LESSONS LEARNED 


¢ In local law enforcement, more than 99 percent of the alarm calls are 


false alarms. Even if they’re not completely “vanilla,” they’re usually 


not crazy-wild. On scene in this case study we saw zero evidence of 


any forced entry or any crime, so the Speed/Level of Urgency 


was minimal. Taking the time to attempt the bypass was reasonable, 


even though I was uninformed and it failed. 


After researching my failure, I learned there are a few options for 


quickly accessing the type of make/model combo lock in this case 


study, the Master M175. One method is now a favorite with almost 


every class I teach, and it requires no tools! I'll teach it to you now: 


If there is already a random code installed, set all four digits to 


Zero. 


Pull really tight on the shackle, as if you’re trying to open it, 
and hold that tension. 


Jiggle the first wheel on the left up and down rapidly. If it is 
really tight and doesn’t budge, loosen your tension on the 


shackle, add one digit (i-e., 1), and apply the tension again. 


If you jiggle that wheel up and down again and it seems much 
looser (I like the term wishy-washy), leave the wheel on that 


number. 
Move to the second wheel from the left and repeat. 


That’s it! Just repeat on all four wheels, holding tension tightly 


on the shackle, and finding the spot on each wheel that jiggles 
quite a bit while the tension is applied. 


e When accessing a locked obstacle or escaping one, you should always 


start your entry with, “I will try to see if I can get this open” rather 
than with, “Watch this shit!” You might not always have a Deputy T 
standing by your side. I’m happy to tell you my failures so you don’t 
make the same mistakes I did. In other words, part of my job is to 


keep you from looking like an idiot! Ha! 


I’ve since updated my First-Line Gear and keep multiple thin metal 


shims as well as a barrette in my wallet. 


CHAPTER 12 
CASE STUDY: 66'D EN ROUTE 


Sometimes when you have a shiny new hammer hanging on your belt, lots of 
problems turn themselves into nails. My colleagues had a new tool to use (me): 
If a front door is locked, stop everything and call Pat, right? Because they had 
“a guy” for that, they'd wait for me. 


Below are some case studies where I didn’t get a chance to apply any actual 
lock picking on an entry call. These will help to bring to life some of the 


decisions that you will surely face during your own Target Assessments. 


MINI-CANCELED CASE STUDY: “CHICKEN 
DINNER” 


I got called to help another unit gain entry into a house. When I arrived, the 
primary officer on scene explained the situation, along with the probable cause 
and the legal/moral reason for entry. I determined my own Moral Right for 
Entry and Speed/Level of Urgency, then started my on-scene Target 
Assessment. I went to the front door and tried the handle. It was definitely 
locked. I walked about six feet to the nearest ground-level window and tried to 


slide it open. Winner, winner, chicken dinner. 


LESSONS LEARNED 


I wouldn't say I “forgot” to check the windows in the case study “Suicide by 
Pills,” but I was focused on one problem at a time. Either way, I learned from 
that experience and implemented that solution here with the window check. 
On this case, there was still precious time that was wasted waiting for the entry 
specialist to arrive. Even though this entry was successful I still was able to add 
new steps to my order of operations, by way of some questions and some 


prompts for personnel on scene that they could do for me before I arrive. 


MINI-CANCELED CASE STUDY: “YOU CAN 66” 


“Hey, 3W61, can you switch to channel 12?” 
I responded, “10-4,” and switched. 


Once we were on the second-priority channel (a.k.a. the Tac-Channel), the 
caller launched into a more casual conversation: “Hey, this is 2W51, we're 
stuck on a Signal 32 here where the victim is alone in the house. She texted her 
boyfriend, and she told him she’s sad and she’s going to do something crazy, 
and she made all sorts of suicidal innuendos. Now she’s locked up in her 
apartment, and we need your skill set to help us make entry so EMS can check 
on her. She told the responding deputies she’s going to end it all, so we have 


our probable cause for entry.” 


My response was something I'd practiced based on my prior failures: “Happy 
to help, but before you switch back to the main channel, I need a few things. 
First, I need you to use your phone and send me a picture of the entire front 
door, top to bottom, then a closeup of the deadbolt if there is one and a 
closeup of the doorknob. And while I’m driving, since it will take me 14 to 15 
minutes to get there, have someone start a walkaround of the 
house/apartment/whatever and try all the doorknobs and windows to check if 


they’re unlocked. Let me know what you find out.” 
We both roger-ed up and went back to the main radio channel. 


Three minutes into my 15-minute drive to the scene, I heard again from the 
caller: “Uh, 3W61, you can 66. We [mumble] found a window [mumble] that 


was open...” 


The bad news was that I got canceled and I wasn’t able to practice my skill 


set...sort of. The great news was that the victim was quickly able to get the care 


she needed. 


I smiled contentedly to myself, not to gloat (because we all know how many 
times I’ve fucked up) but because of being a force for positive change— 
recognizing that a badly needed skill set wasn’t being taught and being able to 


take action to fill a void in life saving training—made me feel useful. 


LESSONS LEARNED: 


¢ In a way, I was able to practice my skill set. I got to add to the “how” 
and the “why” we make entries the way we do in Tactical Lock 
Picking. 
¢ How we make entries the way we do: As practitioners of TLP 
we start assessing our target and directing personnel before we 


get on scene. 


¢ Why we do this: because humans are creatures of patterns (the 
front door is locked, let’s wait for the entry specialist) and we 
aim to exploit these patterns to make effective and efficient 


entries in order to make lives better, not worse. 


¢ This simple case study changed the way my Target Assessment phase 
worked. 
¢ It added in the fact that a robust Target Assessment can be 


done by someone other than yourself. 


¢ It also added in the fact that TLP should be an organized 
system that practitioners should be able to communicate and 


teach to others. 


MINI-CANCELED CASE STUDY: “FINE WITH ME” 


“Switch to 12,” I was told via the radio. 
“Switching,” I responded. 


On the Tac-Channel, I was told by another deputy, “Hey, I’m on this welfare 
check and I’m not sure what I’ve got. Can you swing by and take a look and do 


that thing you do?” 
As always I replied, “Gladly, 51.” 


It was one of the nicer trailer parks in our area of responsibility, and very clean. 


Most of the residents were active seniors. 


My fellow officer met me at the front door of this nice double-wide trailer and 
told me the story: “So this guy’s daughter lives out of state. She called us and 
said she hasn't heard from her father all evening though every evening they 
usually talk on the phone.” 


I responded with a few questions, and the answers were, “No, he does have a 
vehicle, but it appears the driveway is empty. No, I didn’t see any sign through 
any of the windows that anything is wrong. No, I don’t have any reason to 
believe he’s dead or dying inside the trailer.” I did my own walkaround and 
peeked through as many windows as I could. I had absolutely no reason and 


no cause to enter this man’s home. 
Then the request came: “So do you have your tools with you?” 


Of course, I did. I asked why. 


The officer said, “Well, I need you to open this door for me so I can just take a 


look around to double-check.” 


I laid out some facts for him: “We have zero cause to enter this home other 
than the claim ‘my dad isn’t talking to me’ from an out-of-state caller we can’t 
verify. There are no health concerns we are aware of. The man’s car isn’t even 
here. We absolutely are ot going to go poking around in his home on the 


whim of someone with zero evidence. That is not our job.” 


He tried to give me that “well, if we don’t find anything, it'll be like we were 


never there” crap. 
I gave him an even firmer no and cleared the call immediately. 


I walked away and got into my cruiser. Following procedure, I clicked the 
“clear from call” button on my in-car computer. I typed into the screen, “I 
took no action on this call,” legally documenting the case and physically 


removing myself from it as well. 


The officer never asked for my help on an entry again. Which is fine with me. 


LESSONS LEARNED 


¢ I did not get canceled from this last call but I canceled myself from it 
because I couldn't achieve Step 1 for my Target Assessment: Moral 


Right for Entry. 
¢ You are responsible for your actions. 


¢ People will ask you to make entries for them that are wrongful or at 


least gray areas. 
¢ You are allowed to say no. 


¢ If people try to intimidate or coerce you, especially based on rank 
(which has happened to me several times), you can use any of these 
prepared lines: 


¢ “Sorry! I don’t have my tools!” 


“T don't have the right tool for that.” 


“Aw, jeez, I’m not familiar with that lock.” 


“Can you send me that request in an email first, just so I 


understand what you're asking, because I’m a little confused. 
As long as you are a rightful owner of that locked 
house/apartment/building and your request is legal, I’d be 
happy to help.” 


“Ouch! My back! P’ve got to go home now, clock me out. 


Ow...ow...” 


CONCLUSION 


Be prepared to vot use this skill set. And be prepared to use other people on 
scene as resources to help you accomplish tasks for your entry and speed along 
the process. Many courses out there may charge you an arm and a leg to teach 
you how to pick a lock, but no other course I know of (yet) will teach you how 


to implement your skill set in the field in a practiced and principled manner. 


Imagine enrolling in an auto-mechanics course and learning how to change a 
battery and a sparkplug but not being taught how to diagnose a car that won't 
start. TLP is the art of diagnosis. We determine which tool to choose and when 
(and sometimes just as important, when vot to). It is also a game of economics, 
percentages, and timing. It reinforces that our decisions have consequences. 
My number-one goal for every student who walks out of my classroom is to be 
better prepared for the real-life application of this skill set and all the 


unique, exciting things that happen outside of classroom learning. 


CHAPTER 13 
CASE STUDY: POOL FENCE 
REDEMPTION 


Picking by reaching through a gate. (Photo from an entry similar to the one in referenced in this case study.) 


Several homeowners had called 911 about a man breaking into cars in their 
neighborhood. I had answered the call with Deputy T (from the case study 


“Alarm Call Embarrassment”). At one point, at about 1:00 a.m., a homeowner 


outside his front door in his boxer briefs shouted to us, “He ran that way! Just 


jumped the pool fence!” 
Wonderful! We were hot on his trail! 


Deputy T and I decided to split up. I was excited to have an actual bad guy to 
chase whod committed an actual crime, so I went up and over the seven-foot- 


high, spiked-top fence while Deputy T ran the perimeter of the fenced-in area. 


The fence enclosed a community pool and the surrounding grounds, forming 
roughly a huge square plot. The west side of the “square” consisted of a seven- 
foot-high concrete wall, the north and east sides of the seven-foot-high, spiked- 
top fence, and the south side of the same fence interrupted by an entry gate. 
The entry gate was a high-security, magnetic-lock gate with a key card access 


reader both inside and outside the gate. 


While Deputy T checked the perimeter, I used my flashlight to search every 
shrub and dark corner of the pool grounds. Once I'd checked 90 percent of 


potential hiding spots, the pressure was on. 


There was only one place left where the suspect could be hiding. I moved to 
clear it. I yelled out in my big scary-man voice, “Sheriff's office! Hands up!” I 
closed the distance...to find there was nobody behind the last bit of shrubbery 
on the pool grounds. Only seconds later, the radio in my ear started buzzing: 
“Hey, guys [referring to Deputy T and me], I’m here on scene and I just saw 
someone bolting westbound across Main. I’m making a U-turn now to go 


check it out.” 


View of a gate with a padlock on the inside, similar to the gate in this case study. 


View of the inside of a gate with a low-security padlock shielded by an exterior box. 


I looked through the gate at Deputy T: He looked at me. He shrugged his 
shoulders and smiled. I let out a big sigh and said to myself, “Murphy’s Law.” 


At this point, I was out of the game. I looked around and did not want to have 
to climb that fence again so I headed toward the entry gate. Deputy T met me 
there and we ended up talking through the fence and laughing. “Fucking 
thing’s locked!” I said and laughed in exhaustion. 


Deputy T went to interview the nearby homeowner, still in boxer briefs (the 
homeowner, not Deputy T), and the homeowner already had his pool access 
card ready to help free me. Good news/bad news: We had the card in hand but 


the security system’s timed lockout didn’t allow residents access to the pool 


during evening hours. Actually, more good news: A security system that 


worked well. Hooray! 


A low-security padlock but at a very difficult angle to pick. A situation wildly different than picking padlocks 
while on your couch binge-watching TV. (I had to stick my hand through this gate to take a photo of the lock 
on the far side.) 


If you drop tools while picking locks at home, in the best of environments, you can bet you'll also drop tools in 


the field while picking at arm’ length, through an obstacle, sometimes with only one hand, and when the 
keyway and the tools face the ground. Factor this into your approach. 


I really, really did not want to climb my ass up that fence again. It was fun the 
first time but I’ve heard that the majority of injuries to law enforcement 
officers result from jumping fences. I don’t know whether that’s true or not but 
it is believable. Once while tracking a violent suspect with our K9 unit, I went 
up and over a fence and my left foot stayed up on top of the fence while the 
rest of me fell to the ground. My left heel somehow ended up above my head. 


Fuck fences. 


I desperately made another lap around the pool (the pool grounds, not the 
pool itself, though I considered it), looking for options. 


Arriving at a break in the shrubbery, I noticed a sidewalk through the fencing. 
On closer inspection, I saw the pumping mechanisms for the pool hidden 
behind some nearby shrubs. Perfect! This is where the pool guy enters the gate. 
Inspecting further, I noticed a few hinges in the fencing. A side gate! I put my 
nose up against the gate and did the ol’ reach-around, feeling for a release 
latch. I found it, but there was a padlock hanging on it. This was actually great 


news. 


Rust made this lock very difficult to pick. 


Imagine picking open a door or a gate or a padlock at the top of a 10-story stairwell. Dropping tools here and 


dropping tools in the classroom are two very different learning stimuli. 


On one of my recent podcasts (Episode 100), I'd said something like, “Use the 
flashlight and the camera on your phone to reach places your eyeballs can’t.” So 
I did the reach-around again but this time with the selfie camera activated on 


my phone. 


I took a photo of the padlock and saw it was the exact same make/model of 
one that I used at home and that was on my list of “Top-Two Easiest Locks to 
Pick That I Own.” I'd just connected a few wires in my brain utilizing the 


Same Lock, Same Key guideline. 


There are lots of exceptions to learn about in this skill set, but with an 


inexpensive padlock like this, we're talking a 99 percent probability I’d be able 


to open it. 


OMG, this was perfect. A serendipitous chance to show my friend, Deputy T, 
that I’m zot full of shit! 


“Okay [pause],” I said in a very serious tone to Deputy T as we were again face 
to face on either side of the fencing. “This time [pause] it’s gonna work. If it 
doesn't, then [’ll never subject you to watching another entry attempt of mine 


again.” Oh boy. It’s all on the line now. 


The lock was hanging on the far side of this fence. At night. I had to pick it 
upside down, without looking, while reaching through the fence. Slow and 
steady and with purpose, to prevent my tools from falling to the ground. Even 
though my partner could have retrieved them for me, it was a great chance to 


practice being meticulous with my tools. 


Speaking of tools...not only had I picked open this same make/model lock 
hundreds of times but also I had two sets of basic lock-picking tools in my 


wallet and I’d accessed this same make/model lock with those same tools. 


You can’t use tools you don’t have. That is the reason I preach about how to 
organize, store, and carry your tools for field deployment. First-Line Gear 
should always be readily available, which is why mine includes tools that are 
lightweight and inexpensive. If they are a hassle to carry, you won't carry them 


and they'll do you no good. 


In this case study, even if I'd had my tools stored in my cruiser and not in my 
pocket, I could’ve had my partner go to my car and bring me the tools. Still, as 
with all the case studies in this book, by changing just one variable, you can 


learn many different lessons about the real-world application of lock picking. 


Pro Tip: Something else you can’t grasp fully in most lock-picking courses: 
When you drop your tools on the ground in class, you just scoot your chair 
back, lean down, and pick them up. Sometimes in the field, even if you drop 
your tools at your feet, they can be hard to retrieve, especially in tall grass or 
mud, down a sewer drain, or on a flat surface where they bounce away. 


There’s really no tantalizing, edge-of-your-seat story for the picking of this 
lock. I put the tools in the keyway—while, yes, I was physically in a difficult 
position to do so—and they jiggled around in there and the lock opened. 


My partner was very supportive. He said that he believed in me the whole time 
and that my previous failed entry hadn't tarnished my reputation. I hope more 


people strive to be like my friend, Deputy T! 


I love talking about this case study because it covers so many issues that arise in 
real-life field application of this skill set. There are some things you'd almost 
never get the chance to learn if all you did was practice lock picking on your 


couch, binge-watching TV, or at a desk while at a casual lock-picking meetup. 


LESSONS LEARNED 


Tactical Lock Picking is not always about gaining access to a locked 
area. Sometimes having your First-Line Gear on you can be an injury 


saver when you can avoid climbing fences. 


Being familiar with different makes and models of locks can help give 
you confidence in the field. Even on a difficult lock, it can shape how 


you structure the order of operations for your Attack Vectors. 


“Your couch is not the field!” And your kitchen table or home desk is 
not the field. Sitting at home and picking open a padlock that is 
secured in a vice at the perfect height in good lighting is mot the same 
as reaching through a fence with sweaty hands at night and picking it 
upside down. Be sure to practice awkward angles and different tension 


wrench positions. 


Gravity. This is something I try to get my students to utilize a lot in 
my courses. Gravity can be your enemy or your friend. It can help 
make it easier to feed a tool into place (especially for restraint escapes). 
Or the risk of dropping your tools could put your entry or escape in 
jeopardy. 


Not being able to see the lock that you're picking is a very common 
challenge in the field. For your own skill development concerning 
restricted visibility, I recommend trying two different types of 
exercises. 
¢ (1) Get all set up to pick your lock open. The right tools, the 
right lock, the right environment. Now close your eyes tightly 


and keep them shut while you attempt your entry—and 


visualize, mentally, what’s going on with your target. 


(2) Get your tools and your lock setup to pick but now either 
turn off the lights in an interior room in your home where 
NO light is visible or put on a very dark hood that allows you 
to still have your eyes open but where you can’t see anything 
outside the hood (your eyes still able to be open and 
searching, and your brain busy trying to visualize the target at 


the same time). 


CHAPTER 14 
CASE STUDY: WARRANT 
ARREST 


UNDERSTANDING WHAT’S 
REASONABLE 


Without any notification on the radio, a screen popped up on my laptop, 
along with the Pavlovian “ba-bling,” meaning I had a call to respond to. But 
this call was for a district I wasn’t assigned to. I switched my radio channel to 
the district’s dispatch channel and asked for the sergeant. “We need you to help 
us get into a house” was the order. My response—“Hooray!”—should sound 
familiar to you by now. But this case turned out to be a little odd. Very odd, 
actually. 


A very inexpensive setup that can get you through a lot of doorways where the locks may be too tough to pick 
(left to right): a hammer, Bang-It hinge-pin-removal tool, and spring-loaded hinge-removal tool. 


I wasn't as familiar with this district as with my own and I got lost on my way 
to the call. I somehow ended up parking in a church lot and jumping a fence 
to locate the right house in the adjacent neighborhood. After locating the 
house, I jumped the fence again to get to my car, drove to the house, and 
parked the car with all the other cruisers. (At this point you might be a little 
concerned since in the case study “Pool Fence Redemption,” we learned that 
most law enforcement officer injuries occur from fence jumping. But I promise 


you, this was a small fence. It was worth the risk. Hal!) 


As soon as I parked my car, a sergeant I knew only slightly came up to me. He 


seemed a little stressed. Okay, no problem; I actually operate pretty well under 


stress. Game on. 


My first step was to start gathering information about what was happening and 
how I was going to achieve entry. Remember the twin pillars of entering a 
space youre locked out of: “Do I have a Moral Right for Entry and what is my 
Speed/Level of Urgency?” 


The house had an attached garage and the garage door was open. The sergeant 
led me into the empty garage. I asked him, “What's going on?” We were 
standing in front of the interior garage door, which led into the house. Oh, 
and the sergeant had his rifle slung across his chest. We call that a clue...that 


something was up. 


The sergeant explained that one of the patrol units on scene (there were like 
eight cops surrounding the house) had been following a car whose driver had 
an arrest warrant. The driver suddenly parked the car on the street and ran into 


the house with a few other people and they locked themselves inside. 


Wow. First of all... 


Pro Tip: | recommend never, ever trying to lock pick your way through a door 
when someone on the other side may very well have the mindset “I ain’t 
never going back to jail!” 


Which was clearly the case tonight. The people in that house had already 
signaled at least twice they were “never going back:” (1) not stopping for the 
police car behind them when a traffic stop had been initiated and (2) running 


into a house to bunker down. 


It wasn’t “walking away time” yet for me. I'd at least try to see if there was a 


safe way I could help. I was, however, on alert. 


The sergeant wasted no time. “Do you have anything pointy on you?” he 


asked. 
“Excuse me?” I responded, clueless as to what the hell he was talking about. 


“Something like a nail or a screwdriver. Yeah, do you have a screwdriver? And a 


hammer?” 


I did a little headshake and leaned back, as in “Wait...what the fuck for?” Out 
loud I said, “Yes, sir, of course I have a screwdriver in my cruiser somewhere. 


What for, sir?” 


“So that you can bang the pins out of the hinges. You do have a screwdriver, 


right?” 


I said, “Sarge, I know you called me here to help you gain access, that’s my 
specialty. That’s what I do and that’s why I’m here. I’m telling you, this is a 
seven-dollar doorknob and I can have it open in fewer than 30 seconds with 


”» 


my— 
“But you can pop the hinges out, right?” he interrupted. 


OMG. This is super strange. First off, what the fuck is this guy’s fascination 
with those door hinges? And second, not only should you zot lock pick your 
way into a house where the people inside have made it clear they’re not going 
back to jail but also you should vot stand right in front of the fucking door and 
loudly start hammering out the pins to the hinges on the door, especially 


without a shield or a distraction, or fucking something. 


I mentally took a step back and physically took several steps back, away from 


the sergeant and the interior garage door. It was time to cover my own ass (and 


the other officers and the agency) legally and morally. 


I called for the primary deputy on scene, whod started the chase. We had a 


very brief discussion. 


“Hey, so youre saying a car full of people bailed out after a car chase and ran 


into this house?” I asked. 

He confirmed with a yes. 

“And the driver had a warrant?” 
Also a yes. 

“What was the warrant for?” I asked. 


Turns out the guy had been hit with a nonmoving traffic violation and had 
either failed to show up to traffic court or failed to pay the fine, I can’t 
remember which. So for John Q Public out there, let me break this down for 
you: There were cops surrounding the house, asking me (also a cop) to break 
into the house with a reasonable risk to everyone’s safety in order to drag out 
an occupant because of a fucking parking ticket? No. This is not only bad 
tactics but it’s also bad policing and morally wrong. This had crossed a line and 


I was done. However... 


As soon as I'd decided to take no part in entering the house, the sergeant and I 
heard a distinctive ca-clink from the interior door of the garage, the deadbolt 
receding. Then the door handle turned. The person with the warrant and about 
eight other people started rushing out of the house. Thank fucking God 
nobody got hurt in the end. 


LESSONS LEARNED 


Change just one variable and this could have resulted in people dying. 
For example, if I’d started hammering away at the hinges of that door 
and if the people on the other side of the door had grown more 
desperate, and if theyd fired a weapon through the door, I'd be dead. 
Over a traffic ticket. 


Understand that “just following orders” does not absolve you of your 
individual actions. Soapbox Moment: How many Jews did Hitler 
kill? Trick question, the answer is: “He did not kill six million Jews, all 


the people who were ‘just following orders’ did it for him.” 


If it’s morally wrong to kick in someone’s door for a traffic ticket, it’s 


also morally wrong to pick their locks. 


Understand that there are ways to deny orders to make entry and that 
those ways run the spectrum, just as we mentioned in the mini- 
canceled case study “Fine With Me:” 

¢ “Pm not sure this is a great idea. Maybe another option would 


work better?” 
e “Maybe someone else can do it?” 
e “I don’t remember how to pick that lock.” 
¢ “That lock’s too tough for me.” 
¢ “Whoops. I don’t have my tools.” 


¢ “Pm not certified.” (Be careful, though, because if you want to 


make entries in the future, they might not let you if you're not 


certified.) 


e “We're not doing that, it’s not safe. We'll have to find another 


* « No.” 


“Absolutely not.” 
¢ “Ouch! My back hurts all of a sudden. I’m going home.” 


¢ Understand that /egal and moral are not necessarily mutually exclusive. 


Some actions can be: 


¢ legal and moral at the same time 
e illegal and immoral at the same time 
¢ legal but not moral 
¢ moral but not legal 
¢ Your life and your safety are much more important than a paycheck. 


¢ Other people's lives and safety are also much more important than 


your paycheck. 
¢ Heed mental red flags. They’re there for a reason. 


¢ Especially in barricaded situations, understand that very often you 
have all the time in the world to wait. Ask yourself, “If we wait longer, 
is it possible we can find or utilize another solution?” And, “If we wait 


longer, what’s the worst that could happen?” 


¢ Know when zot to use your skill set. Do what is right. 


¢ Sorry for the heavy preaching on this one, but these issues are very real 
and they should be very important to you. Especially for those in law 
enforcement and other first responders, a situation like this could very 


likely happen to you and I don’t want you to be unprepared. 


CHAPTER 15 
GUIDELINE: LEGAL VS. MORAL 


ACTIONS CAN BE BOTH, EITHER, OR 
NEITHER 


Moreover, if one accepts the legitimacy of “laws” (political commands), one 
must also accept that drinking alcohol was perfectly moral one day but was 
immoral the next day—the day “prohibition” was enacted. Then, not many 
years later, it was immoral one day and moral the next—the day prohibition 
was repealed. Even the gods of most religions do not claim the power to 
constantly amend and revise their commandments, to regularly change what is 


right and wrong. — Larken Rose, The Most Dangerous Superstition (2012) 


There is a difference between legal and moral. When I started my website and 
began writing and teaching publicly, I used to conclude many segments with 
the phrase “Stay legal.” After much consideration, I no longer do so. It is my 
hope that in this country, and on this planet, people start focusing on doing 
what is right instead of doing what is legal. As discussed in the case study 
“Warrant Arrest,” things can be both legal and moral, both illegal 
and immoral, legal but not moral, or moral but not legal. 


Legal and Moral: Waking up and taking a walk around your neighborhood. 


Illegal and Immoral: Waking up and shooting your neighbor in the face for no 


reason. 


Legal and Immoral: Killing Jewish people in gas chambers in 1940s Germany. 


Illegal and Moral: Setting up a small food cart near a homeless camp and 


providing free meals to people (in many US cities). 


In Germany in the 1940s, many laws were passed that rendered the Jewish 
population lesser people than their non-Jewish compatriots. And right here in 
the United States of America not too long ago, it used to be legal to own slaves 
—to own other human beings, work them to death, violently punish them, 
and trade them like property. Even less long ago, it used to be legal, and 
considered moral by many, to treat black people as a lesser, segregated race of 


humans. 


I spend a lot of time speaking out about it not being okay to initiate force 
against people or to take or damage people's property. And there are no 
exceptions. (It is moral to use force against someone in self-defense. It is not 


moral to initiate force against a nonviolent person who has victimized no one.) 


This is not a book on politics. But we are going to talk about some legal issues 
to consider, and I want you to know that with these tools and this skill set, you 
are able to make people safer and to even save lives. I hope that no matter the 
circumstances, you always choose being moral over being “legal.” I hope that 
you do not use this skill set to do wrong. And I hope that either way, you take 


responsibility for your actions. 


LOCK-PICKING LEGAL ISSUES 


In the US you can visit Toool.us/laws.html (yes, there are three o’s on purpose) 
and see a full list of lock-picking laws by state. The most important 
consideration that I teach people when they ask whether lock picking is legal 


in their state is intent. 


Intent as it pertains to the legal phrase “must show intent” (and variations) 
means you can have lock-picking tools in your possession legally, but if you're 
doing something that could reasonably be considered actions a burglar would 
take, then the circumstances—the intent you are showing—would turn the 


possession of the tools into a crime. 


There is a second term, prima facie, which basically means that no matter what 
type of legal activity you're involved in or what your intent, just having lock- 


picking tools in your hand or on your person is a crime. 


Please be informed about your local and your state laws (even though they may 


be dumb). 


PRANKS 


Let’s say you work for an organization that has a locker room. Everyone hangs 
out in the locker room, where you shoot the shit together, whatever. Let’s say 
there is one guy who is always boasting about how he could pick open any of 
those crappy lockers and it is widely known he is a practical joker. Let’s say one 
of your coworkers goes to his locker after showering and notices his wallet is 
missing. He looks at the practical joker and says, “Hey, my wallet’s missing. Do 


you know anything about that?” 


The practical joker says with a chuckle, “Sorry man, sucks to suck.” How well 


do you think that confrontation is going to go? 


Let’s flip it. Let’s say you pick locks and your coworkers know about your skill 
set. Let’s say when they've asked you to help them get into locked obstacles, 
youve tended to respond sober-faced with a by-the-book routine about policy 
and ownership and approval, etc. How might the same locker room scenario 
play out differently for a guy who steers clear of jokes and pranks when it 


comes to his lock-picking skill set? 


For example: “Hey, Lock Picker, our coworker drove me to work today in their 
car and I left my wallet in the front seat. Can you pick the car door open real 
quick and let me in?” To which you respond by writing down the date and 
time, the license plate number of the car, and the name of the requestor, and 
you inform the owner about the request and ask whether they are aware of it. 


Because you felt uncomfortable with the request. 


I’m very familiar with this scenario, and it’s always funny how the requestor 
gets a shitty look on their face and turns beet red. Almost like they know that 
what they are requesting is less than moral and that they should have gotten 


permission (or the actual keys) from the owner of the vehicle. Amazing how 
people don’ really like being held accountable for their own actions. Amazing 


but not shocking. 


This is an example of a lock picker being ethical to a fault, and with enough 
time and consistency, people will become well aware that practical jokes or 


wrongful entries are the farthest thing from your mind. 


Legal and moral tie closely together, but remember, they are not the same 
thing. I have ethics discussions with every single student of mine where I use 
this example and others. I remind students that it is in their legal, moral, and 


ethical best interest to not get involved in practical jokes with this skill set. 
Let’s explore the issue further. 


When I was active in law enforcement, I attended a “Law Enforcement Only” 
lock-picking course. Legal issues were barely covered. The saddest part was 
when the instructor (a former police officer) said to a room full of police 
officers, “Yeah, have fun with this. Go pull pranks on people with this new skill 
set. If you have a funny one, go ahead and take a picture and send it to us. We 


love pranks!” 


First, right off the bat, if in your place of employment you have a locked office, 
locked desk drawer, locked file cabinet, or locker containing personal 
belongings, you have an expectation of privacy. Even if it’s posted that 
“Management reserves the right to search, blah blah, blah...” you can expect 
that once you lock that space, it is reasonably private. Violating someone else’s 


privacy for your amusement is morally wrong. Period. 


Second, especially if you’re a cop, what happens if you're pulling a prank in 
someone's vehicle and you happen to find evidence of a crime? Do cops 


commit crimes? Yes. You might be shocked, but we call breaking into 


someone's car without their permission...any guesses? A crime. What do we 
call being a cop and committing what could be considered a crime (and what 
is definitely not moral) and finding evidence of a crime you can’t prosecute 


effectively because the evidence is inadmissible? A disaster. 


Third, encouraging others (especially those who are supposed to be held to a 
higher standard, LOL) to violate privacy and commit a possible crime for the 


sake of a laugh makes you just as culpable. 


CONCLUSION 


People murder other people with their bare hands every day and we can’t 
exactly ban human anatomy. Same goes for guns. Guns are used for good and 
for bad. The internet is used for good and for bad. And lockpicks are used for 
good and for bad. (And honestly, they are provably used for good way more 
often than they are used for bad). 


My purpose in this entire book, as well as on my podcast and in my courses, is 
to get you to ask questions and to consider perspective. I offer you new 
perspectives not only on how to unlock the physical world around you but also 
on how to unlock your mind. And let you make your own determination about 


things. 


Because I have the platform, the ability, and the passion, I would be remiss if I 
did not repurpose the horrible experiences from my line of government work 


and try to spread awareness and ask people to ponder their perspective. 


On a final note, if you're at all familiar with any of my other content, you've 
probably heard me say, “Titles don’t mean shit.” Just because you're a cop 
doesn’t mean you know the laws pertaining to lock-picking tools (most cops I 
worked with had no clue). Wearing uniforms or “costumes” doesn’t 
automatically make you a good person. Just because you wear a particular 


badge and uniform doesn’t mean youre evil either. 


I’m not a lawyer. Nothing in this book should be considered “legal advice.” But 
here are some conclusions—merely food for thought—regarding lock-picking 


legal issues: 


¢ Picking open a locked obstacle you have neither the legal nor the 


moral right to access is just as wrong as using an axe to smash it open. 
The tool you use doesn’t change your moral 
accountability. 


Whenever you can, stay legal. (Keeping out of jail is a good thing.) If 


you cant, at least have the right moral intent. 


If you're ever suspected of illegally breaking in somewhere or of 
playing a prank with your lock-picking skill set, I’m sure you'll be 
happier if you have a reputation for using the skill set properly instead 
of misusing it by being an asshole and a joker. Start solidifying a 


pattern that makes it clear you stay far away from morality’s gray areas. 


e As two famous modern philosophers once said, “Because with great 
power, comes great responsitrillitrust.” — “Prepared for Terries,” Key 


& Peele. Comedy Central (2015). 


CHAPTER 16 
CASE STUDY: VEHICLE ENTRIES 


An entry I did for a friend. It took me less than 20 seconds to earn myself a six-pack of my choice of beer. 


VEHICLE CASE STUDY: “SURE, YOU TRY" 


A very long time ago, I kept my very first set of auto-jigglers in a plastic zip- 


bag in the glovebox of my car (you can see how far I’ve come). 


I had just finished my first CrossFit workout and the cardio almost killed me. 
A fellow athlete had locked their keys in their car and I was happy to help. 
Except it turned out that I couldn’. I got the jigglers from my car, inserted 
them in the keyway, jiggled them around, and was not able to close the deal. 
Or “open” the deal. ;) 


A friend of mine, Danny, was looking over my shoulder and asking questions 
about how the technique worked. While still trying to jiggle open the keyway, 
I explained the process. He asked if he could try and I happily obliged. From 
my high horse, I assumed he didn’t have as much experience as I did, but sure, 
I was glad to have a fresh set of hands give it a shot. I’m embarrassed to admit 
it but I thought or said something like, “Well, you probably won't be able to 
open it, but good luck!” Ugh. The memory makes me cringe. 


Danny put the jigglers into the keyway, and I coached him to apply gentle 


turning pressure while moving them in and out and up and down. 


Danny paused occasionally, and I could see him trying to mentally feel his way 
through the lock. He said, “I think there’s just one pin left for me to pick.” The 
lock turned over, and we all watched the inside of the door’s lock indicator pop 


up and into the unlocked position. 


LESSONS LEARNED 


¢ Even though I was “supportive” of having someone else try the lock, I 
was less than optimistic about his chance of success. But from then on, 
my view of less-experienced pickers forever changed. I viewed them as 
on-scene resources and potential force multipliers. (Note that in the 
case study “Broken but Not Dead,” I asked the primary officer to try 


to bump the front door open. More curriculum shaping in action.) 


In many of the case studies in this book, I give people crash courses, 
sometimes in person and sometimes over the phone or computer and 
help them to learn a new technique and to successfully make entry all 
at once. This is an important skill you may want to start practicing: 
Teaching others. Oh, and staying humble is a skillset you should 
probably practice as well. 


VEHICLE CASE STUDY: “YEAH, BUT WHY?" 


The phone rang. “That’s odd,” I thought. TJ and I hung out on occasion, but 
we usually didn’t call each other off duty. 


“T need your help,” he told me, seemingly under pressure. “Being that I’m the 
new guy on SRT, it’s my responsibility to drive the team to training and then 
drive them back to the station. And we're all hot as fuck and tired and sweaty, 
and yours truly locked the keys in the van. What do I do?” Yes! A fun one! 


Pro Tip: When using this tactical skill set, we will sometimes ask very specific 
questions in a very specific sequence to help us narrow down our order of 
Operations. 


While this was not a high-risk entry for most involved, failure certainly would 
have a big impact on TJ. At a minimum, he'd undergo some hazing. So I had 
plenty of time to formulate my plan and to walk him through a Target 


Assessment. 


“Let’s get down to business, brother,” I said. “You're training at the jail, right? 
That means there are probably a few similar fleet vehicles nearby. Tell me if you 


see other vehicles from the same manufacturer.” 
A confused yes was his answer. 


“Okay. Is there any way you can borrow the keys from some of the other fleet 


vehicles for a few minutes?” I asked. 


All these similar vehicles lined up together should be an indicator to you. Remember, your environment will 


talk to you. You should try to listen. 


A sampling of different keys for the same make/model of vehicle. 


“Yes, but I can’t drive the team home in another vehicle. All our shit is still in 


the vehicle I locked.“ 


“Tm not gonna steer you wrong [#vehiclepun]. Just answer me. Is there any 


way you can borrow some keys from the other fleet vehicles?” 
“Ves,” 


“Okay. Go get some keys, take them all back to the van you locked, then call 


me back.” 


Short pause...then another phone call: “Okay, I’m at the van with these other 
vehicle keys. Are you telling me I should just try these other keys?” 


Honestly, I hadn’t even thought of that. I was focused on guiding TJ through a 
specific technique but he wins a point for creativity because, believe it or not, 
sometimes your key will work as a 100 percent match with other vehicles. It 


happens. 


I replied, “Oh yeah, of course. Try that first.” Smooth. Real smooth, Pat. But 


alas, none of the other keys was a perfect match. 


Te. a 
A view of the wafers inside of a wafer style lock. All that needs to happen for a locked wafer lock to open is that 
the wafers must reach a height that allows the edges of those wafers to slide under the shell that is keeping them 
from turning. 


“Okay, next pick one key and follow me step by step. Ready?” I continued. 


(<4 Ready.” 


“Put just the tip [giggle] into the keyway of the driver door.” 
Check. 


“Turn the key toward the front of the van. So counter-clockwise.” This was a 


50/50 shot. 


Check. 


“Now keep a gentle turning pressure on the key while you push the key in and 
out, and move it up and down a little too. It’s important to keep applying that 


light turning pressure.” 


Lesson: If your vehicle’s door locks are a wafer lock—type mechanism, you 
now have enough information to try this technique! It isn’t rocket science. 
Still, as simple as it is, it could save your life or the life of a loved one. 


Check. 


“Okay. Keep trying this technique with all the different keys you have. Try it a 
few times while turning the key to the left, then try it a few times turning the 


key to the right. Call me back in five minutes.” 
Check. 


I kicked back on the couch at home and patiently waited for a response. If it 
was a no, | could arrive at the training site with my tools in just 15 minutes to 
earn a six-pack of beer. If it was a yes, I was getting a free six-pack just from 
sitting on the couch. That was my going rate if you called me for an entry 


when I was off duty. 


Important Lesson: See? Another perk to learning this skill set! 


Between five and 10 minutes later I got a text: “Dude! You're the man! I can’t 


believe that worked. Saved my ass, big time!” 


CONCLUSION 


I’ve used this “over the phone” technique for many different types of entries 
and so have several of my students. The curriculum I teach is designed 
so that students can teach it to others. Tactical Lock Picking is not 
only something to learn to do but also something to learn as a system toward 
understanding how to perform a technique, how to troubleshoot, and how to 
be creative and problem-solve even when youre not physically present. And, of 


course, how to coach someone else on scene. 


There was not a ton of information to learn from this case study, a successful 
entry doesn’t force you to learn or to change what you do. This is another 
reminder that you should use your failures wisely, as a stimulus for positive 


change. 


VEHICLE CASE STUDY: “SET UP PERFECTLY” 


This case study, written in first person, is by my very first TLP student, Jordan. We 
used to blindfold each other on deployments and crawl around the training room 
floor looking for lock picks and paperclips, and wed pick open padlocks and 
handcuffs while doing pushups and planks and in between sets of pullups. One of 
the few things I miss about being deployed was training eight hours a day, five days 


a week. 


There I was at the police academy, finishing up for the day, and I almost made 
it out of there on time. But I got caught up with something and walked out of 


the academy doors like 10 minutes late. 


I noticed a female cadet standing outside her car with two or three people 
standing near her. The parking lot was otherwise a ghost town. So, of course, I 
went over to see what was going on. Turns out the cadet locked her keys in her 


car and they were sitting right there on the front seat. 


Makeshift tools are all around you. Keep stretching that creative-brain muscle! 


The technique that you [Pat] explained to me came to mind, crystal clear. 


While the cadet wasn’t in my class, she was in the class ahead of me, so I knew 


she wasn't out there stealing cars. 


Everything was set up perfectly. All the different schools here—Fire, EMS, 
Police—have classrooms in the same building. One of the onlookers was in her 
nursing scrubs, so the first thing I did was ask her if she has a blood pressure 
cuff. She didn’t have one on her, but she said she had one she could grab from 
inside the building. I sent her to do that, and the cadet and I went inside in 


search of a few wire coat hangers. 


Once we were all back at the car, we pried open the car door just a fraction of 
an inch with our fingers and started feeding the blood pressure cuff into the 


doorframe. It took a few of us working together to do this. 


Once we got a bit of the cuff in we pumped it up as much as possible, but it 


was tricky. While filling up with air it would try to push itself back out of the 


doorframe, so we had to keep positive pressure on it. 
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Inserting a blood pressure cuff in between the vehicle door and doorframe. 


Using a rigid item, a credit card, folded into the airbag to help push the blood pressure cuff farther into the 
vehicle. Have you ever tried pushing rope? It is not an easy thing to do. 


A blood pressure cuff inserted into the vehicle and pumped up. 


Coat hanger successfully penetrating the vehicle’ interior. 


Two coat hangers twisted together to add rigidity. 


I remembered your instruction on inserting a credit card into the fold of a 
blood pressure cuff to help with rigidity. The cuff then expanded the 
doorframe a little bit more and we were able to get a better grab on the door. 


We pulled harder and were able to get a lot more of the cuff inside. 


We pumped up the cuff again, and once it was inserted farther into the door 


we had enough clearance to start with the coat hangers. 


I thought I could just straighten out the wire hanger and create a hook at the 
end to pull out the keyring, but I soon realized there wasn’t enough room in 


the gap between the door and the frame. There was an unlock button on the 


door. Unfortunately, the wire hanger was wobbly, and I struggled to get the 


button to unlock. 


CONCLUSION 


As a team, the other cadets and I straightened a second hanger and twisted the 
two hangers together, which gave the tool a lot more strength. I fed it into the 
vehicle and poked the unlock button, and I saved the day with the help of the 


people on scene. 


Lesson: If you hear about an idea for a makeshift tool to open a lock, try to 
test it out before you have to rely on it in the field. But if it’s all you’ve got, 
you should go for it. Also, you should always keep a lookout for people to help 
you, whether that’s someone who knows how to pick a lock or someone who 
you can give a crash course to or just extra hands to pull open a car door a 
fraction of an inch. And, as always, be creative. 


LESSONS LEARNED 


As with all our other case studies, the first two things you should do, usually at 
the same time, are to determine your Moral Right for Entry and 
Speed/Level of Urgency. Then manually check all the entry 
points to see if they might be unlocked. 


¢ Tactical rule of thumb (for vehicles): The older and less expensive the 
car is, the more likely you will be able to use an auto-jiggler attack to 
gain entry through the keyway. 
¢ Beware: More and more vehicles are being produced now 
with keyways that are mot wafer locks. The jiggler technique is 
most successful on standard, low-security wafer locks. A quick 
internet search on your phone for a vehicle’s make/model 
should be able to tell you what type of lock you're dealing 
with. 


¢ When attempting entry on a vehicle, there’s a good chance you could 
scratch the paint, break a window, or cause some other type of 
damage. As with all entries (and especially with vehicles), first make 
sure you have your MRE, then whenever possible, warn the owner 
of possible damage. 


e My best recommendations for upgrading security for your vehicle are 
to park somewhere smart, leave valuables out of sight, lock the vehicle, 
and equip it with some type of alarm system. (Not much by way of 


“infrastructure” upgrades.) 


¢ There are a lot of odd vehicle-entry tools out there that claim to be 


magic, but they are not. Be cautious about spending money on “magic 
bullet” vehicle-entry devices. As with any tool, practice safely and with 
permission on as many vehicles as you can before you have to rely on 
it in a high-stakes situation in the field. Often in the lock-picking 


arena the marketing doesn’t always match a product’s capabilities. 


CHAPTER 17 
GUIDELINE: GATES 


BIG OBSTACLES, BIG SOLUTIONS 


The guidelines discussed here apply to all sorts of gates: Pedestrian gates, 
vehicle gates, manually operated gates, electronically locked gates, magnetic 
locked gates, automatic opening gates, daisy chains, and more. Start to look for 
patterns and begin to see all the different points of attack you can try to 
manipulate. Be sure to examine the entire obstacle and its associated hardware, 


not just the padlock on a chain or the keypad near an entrance. 


—— 
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Various big obstacles I've encountered and had the pleasure of assessing. 


FAUX-LOCKED GATES 


Several patterns emerge with gates that are padlocked shut using a simple latch 


or length of chain. One of the most common and easiest type of “locked” gate 


you can defeat is the faux-locked padlock. 
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There are people, professionals even, who would sit in their car on scene, look at this lock from a distance, 
consider the gate “shut and locked,” and give up and wait for someone to help them. Fully inspect your target 


and don’t assume. 


People use the faux-lock option for many reasons and they're not wrong; the 
assumption is, “Well, it'll look locked, so most people won't mess with it.” 


There have been times when first responders have pulled up to a scene, seen a 


vehicle gate padlocked, stayed in their vehicles, called me, waited for me to 
arrive, and I’ve walked up to the gate and found the lock only appearing to be 
locked. Knowing this is a thing will help you. And doing a thorough Target 


Assessment will help you too. 


HIDDEN LOCKS ON A CHA/N 


From a distance, or even up close for those who dont pay attention to detail, there would appear to be a heavy- 


duty lock securing this chain. A bit hidden, to the left, is a less-secure, easier-to-pick brass padlock. A good 
friend of mine, with no experience, after only my standard “60-Second Crash Course” was able to pick that 
padlock on his first attempt. 


It is common to wrap a length of chain around two posts and hang a faux- 


locked padlock behind the posts, out of sight, or to hang no lock behind the 


posts and make it appear that a padlock is there though it’s out of sight. People 
outside the gate would have to maneuver the chain around to find either the 
lock, the faux-lock, or no lock. When you need entry somewhere (and, of 
course, you have your Moral Right for Entry), remind yourself to do a 


thorough inspection of a locked obstacle instead of just fucking giving up and 


saying, “Oh no! [sobbing] There’s a chain wrapped around that post! It’s 
locked! I’m stuck!” 
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This gate is chained shut. In other words, “This gate is locked.” Right? Well, you could say it is “chained” shut. 
But from this far away could you really say it is “locked?” Remember to always do a thorough 
Target Assessment before you give up. There might not be a lock on this chain at all. If there is a lock it 
might be “faux-locked” so it only looks like its locked. Or it might actually be locked but with a low-security 
padlock. Or it might be daisy-chained with multiple padlocks, some of which may be really low security. 


There is nothing wrong with using resources or being creative or “cheating” as 


long as you have the MRE through a lock. There is nothing wrong with a 
destructive entry (when it is reasonable) or with calling a locksmith on a moral 
entry. There is nothing wrong with checking the internet and watching some 
14-year-old show you how to make entry through a particular make/model of 
a lock. All of the above are actually encouraged in the system I’ve designed. But 


there is something wrong with giving up. 


DAISY CHAINS 


A very common practice on vehicle gates is to lock the gate with a chain and to 
padlock two (or more) points on the chain, though if you open any of the 
padlocks, you have 100 percent access. Strangely this is almost always done 
with padlocks of two different types or two different security levels (e.g., a 
high-security padlock and a low-security padlock). We call this daisy chaining. 
We talked about it in the case study “Closed Park.” 
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Examples of daisy-chained padlocks on gates. Fun Fact: That big red padlock (where a tiny friend hangs out for 
a photo-bombing opportunity) has nothing to do with keeping the gate secured. It serves no purpose. 


I’ve also witnessed an obstacle that appeared to have a chain and a high- 
security lock, but on further inspection I found a daisy-chained second lock, 
hidden behind a post, that was much lower security. Here a hidden-lock 
technique was used to hide the fact that the obstacle was daisy-chained with 
different levels of security. Beating a dead horse here, but...do a thorough 


inspection of your locked obstacles. 


MULTILOCKED OBSTACLES 


This and other photos of the building referenced here are provided by an Instagram friend of mine (@bre_cha_, 


with permission). 


What can we learn about effective multiple-lock systems from the little 


building shown in the photo? 


* 


If we look up close at the door to the building (see photo), we see three 
different padlocks holding it shut along the right side: Top, middle, and 
bottom. Along the left side of the door are some hinges. Often people will 
install several deadbolts on their door only to have the hinges popped and the 
door removed completely from the frame. It is hard to say from a distance 


what effect these particular hinges would have if popped. 


The top padlock appears to be a disk-detainer type. This is not the most 


common type out there, so not many beginner lock-pickers spend a lot of time 
becoming familiar with it or how it works. It requires special tools that differ 


from pin tumbler picking tools. 


The middle lock can be picked using First-Line Gear recommended in this 
book, even by beginner lock-pickers. It might take a few minutes, but the lock 
can probably be raked open and definitely single-pin-picked by anyone who 


has spent time mastering the basics. 


The heavy-duty bottom padlock would be very difficult for a beginner to pick. 


It would also be very difficult to pick if you had only your First-Line Gear on 
you, as there are security pins in the lock and the tension is a little trickier than 


with your standard padlock. 


To make an entry through the keyways in this door youd need to have plenty 
of different types of pick tools with you. Even with bolt cutters you'd probably 
have a hard time, since it appears the top lock has shielding (i.e., a metal 


obstruction on the lock or in the immediate environment that makes it 


difficult to reach the shackle). 


Removing only one or two of the padlocks here would not result in entry. 


You'd have to remove all three for the door to open. 


The door is by no means impenetrable, but it certainly has several levels of 


security you'd have to defeat before you could make entry. 
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(Top) A padlock with shielding, which prevents bolt cutters from easily reaching the shackle. (Bottom) A 


standard disk-shaped padlock, which has its own form of shielding, here provided by the furniture on which it 


is mounted. 


EX/T BYPASSES 


The locked side of the pedestrian gate referenced here. The door has a lock with a high-security pin tumbler 
keyway. 


Most pedestrian gates, and even most vehicle gates, are wildly susceptible to 
exit bypasses because most are locked on one side and have some type of “push 
to exit” mechanism, always unlocked, on the other. If, from the locked side of 
the gate, we can send an exit input to the locked obstacle, that obstacle may 


auto-open or manually open for us. 


An inside view of the pedestrian gate, showing the latch and the dead latch mechanism along with the opening 


in the hardware allowing a hand or a tool to fit through to push the exit push bar. 


My first attempt at bypassing the locked pedestrian gate was with my 
OscarDelta Luggage Tag shim tool to see if I could push the tool up against 
the latch. The deadlatch mechanism, however, wouldn't allow a latch bypass. 
But there was plenty of room to fit my arm through the opening in the 


hardware where the lock was mounted. 


With my tool still in hand I did the old reach-around and fingered the spot 


where my hand rested until the mission was achieved. Successful exit bypass 


entry! 


FURNITURE BYPASSES 


Always be on the lookout for furniture bypasses as well. This is where you 
would disregard the keyway and the latches and chains, and you would affect 


the mounting hardware “furniture” that the locked obstacle is attached to. 
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The yellow post lying on the ground fits into the empty hole in the street. With the post pulled out you can easily 
drive around the one-arm lift gate. Always do a full and thorough Target Assessment! 


Two of the easiest examples of this are removing the hinge pins from a 
standard residential or low security commercial door taking the whole door off 
of the frame by just a simple hinge pin removal and unscrewing any mounting 


hardware for padlocks hanging on a simple hasp. 


SENSOR HACKING 


I know of at least three methods for “hacking,” or “tricking,” an automatic 
vehicle-gate exit sensor. If you can “trick” this sensor, you can drive in through 


the out gate (assuming there are no one-way spikes). 


Vehicle-sensing loops. (Note the rectangles that appear to be etched into the ground.) 


First: I’ve tried pushing and pulling a shovel (or a metal ladder, etc.), as one 
would a shuffleboard stick, across the ground. This is hit or miss, though I have 


gotten it to work. 


Second: I’ve held an industrial-strength magnet in my hand and walked over 
the exit sensor to trip it, with instant success. (While a very effective tool, an 
industrial-strength magnet is also very dangerous and must be handled with 
great care and respect.) Less-powerful magnets aren’ as effective, so you need 
to experiment with ones of different strengths to be prepared to use them. The 
Magneto tool I carry in my Second-Line Gear has proved too weak for the 


vehicle gates I’ve tested it on so far. 


Third: I’ve heard that people drive electric remote-controllable skateboards over 
vehicle sensors to trip the sensors. I haven't yet shelled out the several hundred 


dollars to purchase one and give the method a try, but in time I will! 


Be on the lookout for any other miscellaneous items in your environment you 


may be able to drag across the sensors. 


VEHICLE POSITIONING 


This is very important and could make or break an emergency entry for a first 
responder. (Remember, I use this term first responder to include those who have 
made the decision to respond to emergencies either by profession or those with 


no professional title that just choose daily to help others.) 


Imagine with me a one-lane, entry-exit vehicle gate. Imagine that the first 
person arriving on the scene of an emergency drives up to the gate, parks their 


car, climbs over the gate, and runs toward the emergency to help. 


Imagine being the second person to drive up to the gate, who actually has a 
key to the lock or has lock picks or breaching tools like a pair of big bolt 
cutters. Imagine successfully getting the gate open. Now you have an open gate 


but can’t drive through it because the first person on scene positioned his vehicle 


poorly. 


What if you are the first person on scene, and although youre well versed in 
lock picking, you can’t open the gate? Or what if you're in a rush and you have 


to leave your vehicle? 


Always consider the logistics of blocking in other responders with your vehicle. 


Lesson: Please be aware of where you park, and please communicate to any 
other responders that they should position their vehicles appropriately. This is 
another great example of something you can direct others to do via phone or 
radio while you’re en route to an emergency. 


VEHICLE GATE SCENARIOS 


I’ve designed the variables in these scenarios to guide you in what to think 


about and how to navigate your options. 


Call it war gaming or call it exercising your brain muscle but getting into the 
habit of thinking through potential problems so youre primed to face them in 
the field is a good thing. After your first run-through of the scenarios, feel free 


to switch out variables. You'll see how quickly the entry can change. 


SCENARIO 7 


Similar to our case study “Closed Park:” You're locked inside a parking lot 
somewhere semirural. The double-swing-arm steel gate is secured with a chain 
and padlock. You can’t drive around the gate and either you don’t have your 
lock picks with you or youre unable to pick the lock. It’s nighttime. Your 
vehicle is low on gas, and your cell phone is losing battery power. You're 
unfamiliar with the area (though it’s not necessarily a “bad” area). It’s a Sunday 
night and you need to be at work in the morning. Do you ram the gate with 


your vehicle? Would that be reasonable? 


Please put the book down now and before continuing, think your way through 


this scenario a few different ways. 
Pause. 
Things to consider: 


¢ What is your Level of Urgency (LoU)? 


Is it reasonable to walk somewhere to get help? 


Even with your phone on low battery power: Can you call a cab or use 


a ride-sharing app? Can you call 911? A locksmith? A friend? Can you 
send text messages or emails to people who might respond and help 


you out? 


Are you thinking outside the box in your attempts to pick or bypass 


the gate? Is there something you might have missed? 


Did you double-check all possible lock and hardware attacks? 


Is a furniture bypass available? 


Can you sleep in your car? What’s the weather like? 


If you damage the gate, will you be held liable? 


Have you checked whether the gate is faux-locked? 


Is the gate daisy-chained with another padlock, maybe hidden and 


hanging behind the gate, out of sight? 


Could you makeshift tools from your environment? 


GATE - SCENARIO 2? 


You, your spouse, and your two children, ages nine and 12, are on vacation. 


Youre staying in a rural cabin. 


You and your spouse leave the kids in the cabin so you can drive your minivan 
a mile up to the vehicle-gate park entrance and then a mile past the gate to 


pick up some items from the general store. As you arrive at the store your 


children call you. They say they saw a man peering in through one of the 


windows, and when they screamed the man ran away. 


You and your spouse rush to the minivan and tear ass down the road, but the 
vehicle gate is padlocked shut. You're parked several feet from the gate, which 
is a manual, double-swing-arm steel gate padlocked in the middle. From inside 
the minivan, you can see the padlock hanging at the center of the gate. You 
also see a sign posted at the gate: “Maintenance closes and locks this gate every 
evening at 9:00 p.m. to allow access only to registered guests. If you are a guest 
and require access, please go back up the hill to the general store and have 


them call on-duty maintenance for the key.” 


You have your First-Line Gear lock picks with you, but youre not familiar with 
the type of padlock on the gate. Who knows if it'll take 10 minutes to open or 
just 30 seconds. It’s a two-minute drive back to the general store, and it’s a 
two-minute drive past the gate to the cabin where your children are. It’s a 10- 
to 12-minute jog to the cabin. At this point do you say, “Fuck it!” and get back 
in the minivan and ram the gate? Do you leave the minivan parked at the gate 
and jog to the cabin to protect your kids? Can you think of several different 


options for how you would handle this scenario? 


Start thinking about all the variables, and consider all the consequences of your 
actions. Please put the book down now and before continuing, think your way 


through this scenario a few different ways. 
Pause. 
Things to consider: 


¢ Do you split forces? Your spouse drives up the hill for the gate key and 
you jog to the cabin? 


Do you both leave the minivan parked in front of the gate and jog to 
the cabin together? 


How’s the weather? Is it snowing? 

Is it pitch-fucking-dark out? 

Have you picked open the same make/model padlock before? 
Is it one that you could open if you borrowed paperclips? 

If daisy-chained, which lock would be the easiest to pick? 
Exactly which tools do you have? 

Can you makeshift a picking tool or a destructive-entry tool? 


Have you done a thorough inspection? You could discover an open 
padlock on the gate. (This inspection might not take long at all; a very 


good assessment can happen in the blink of an eye.) 


Are your children in imminent danger? (Is the door kicked in? 


Window smashed?) 
Is this a false alarm? 


Is your vehicle capable of ramming through the gate? Can it build up 
enough speed? Is the front grille the correct height? Is the gate 


reinforced deep into the ground? 


If you leave your minivan parked right up against the gate on the 
narrow entrance road and jog to the cabin to protect your kids (they're 


in imminent danger) and then end up needing local law enforcement 


or medical help, how the fuck will first responders get through the 


gate with the minivan blocking access? 


This scenario was designed to be a slightly gray area. With just one variable 
change, you could go from speeding in your vehicle to get the key to rightfully 
ramming the gate. Here’s the change: instead of the man running away when 
your children screamed, what if he was trying the knob to the front door of the 
cabin in an attempt to open it and walking around the cabin, trying all the 


windows? 


The real kicker here is probably the imaginary conversation you had with your 
pretend kids on the phone. Were they screaming out of fear because the man 
peeped like a predator into the cabin window? Were they screaming because 
they were surprised? Maybe a fellow guest thought the cabin might be his so 


for two seconds he looked into the window? 


It’s okay there’s not a black-and-white solution to some of these scenarios. Just 


playing with the variables is an achieved goal. 


SCENARIO 3 


Let’s set the scene in a small town where most of the students and staff at a 
local high school know most of the parents on sight. You are not law 
enforcement or a first responder but you are a responsible rifle owner and you 
are doing some afternoon hunting with a friend who is a sergeant with local 
law enforcement. You and the sergeant each get a call on your cell phone: 
“Dad, we're hearing gunshots in the hallway here at school! We're hiding in our 


classrooms behind locked doors.” 


You and your friend throw your rifles into the truck, and you start fucking 


racing toward the high school, where you both have children who are students. 


You're doing 70 mph on a 30-mph street, heading straight for the entrance to 
the school’s parking lot. You see a few dozen students sprinting in terror into 


the parking lot, trying to escape the school as fast as they can. 


You're stopped at the parking lot entrance, staring at a pesky double-swing-arm 
steel gate with a chain wrapped around the middle, padlock hanging off it. 


Finally...2ow do you ram the gate? 


Start thinking about all the variables, and consider all the consequences of your 
actions. Please put the book down now and before continuing, think your way 


through this scenario a few different ways. 
Pause. 


Things to consider: 


What if one or both of you is injured during the gate ramming? Going 
from two armed protectors to either one or zero would halve or 


completely eliminate your first-line response to this emergency. 


What if the gate is rammed open and the vehicle is in working 


condition but the airbags have seriously impaired you and your friend? 


What if the vehicle doesn’t make it through the gate? Youre still 
hazarding injury and also risking slowing down or stopping 
police cars, armored vehicles, and ambulances. 


If you don’t ram the gate, don’t park right in front of it. For the 
love of God. 


While frowned on by school staff, can you drive over the grass or any 
low bushes near the gate? That would reduce your risk of injury. It also 


would not block the gate for other responders. 


Can and should you park off to the side of the gate and start sprinting 
toward the school with your rifles? (Remember, in this scenario, 
students and staff will likely recognize you. But after you think 
through the scenario a few different ways, consider what you would do 
if you were an armed protector who was out of uniform and not 


known to people at the school.) 


With more than one armed protector, make sure that before or during 
your response, one of you calls 911 and describes to dispatch exactly 
who you are, what you look like, and what you are wearing and 


explains you are the good guys! 


CONCLUSION 


Vehicle gates present unique problems and also have unique solutions. Always 
be sure to make the smartest and most efficient morally acceptable entries, no 
matter the situation. Yes, there is a time and place for ramming your vehicle 
through a fucking gate. And there are circumstances where that is totally 
unacceptable. Tactical Lock Picking focuses on specialized, minimal-effort, 
nondestructive (or less destructive) methods while encouraging practitioners to 
consider al/ entry methods and confirming that creativity, efficiency, and 


effectiveness are rewarded. 


CHAPTER 18 
CASE STUDIES: 911 DROPS 
THE BALL 


CASE STUDY 1: “THESE THINGS REALLY HAPPEN” 


Imagine being a mother at home with your very young children. Your spouse is 
at work. You call him on the phone to talk to him for (what is unbeknownst to 


you) the last time of your life. 


From watching TV and movies you may think this person has no way out of their predicament. Wrong. Every 


single one of my students escapes from several different types of restraints, duct tape being one of the easiest to 
defeat. 


Imagine a stranger walking into your home. He ties you up and throws you 
into his car, which is parked in front of your home. Your children are left at 


home in a crib. 


Imagine your kidnapper drives you around for a while, and then he takes you 


to his home not too far away. 


He forces you into a room in his house, puts more restraints on you, and 


violently rapes you. 


Imagine him putting you back into his car and driving you to one of his 


friend’s homes. 


He leaves you, bound, in his car and goes inside to grab a shovel, a gas can, 


and a flashlight. 


While he is in his friend’s house and you are waiting in the car, you are able to 


find your abductor’s phone and dial 911 from within the car. 


Imagine you are on the phone with the 911 dispatcher when your abductor 
gets back into the car. You even manage to outsmart your abductor by 
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answering the dispatcher’s questions while pretending you are talking to the 


kidnapper. 


Imagine that while you are being driven around town again, you scream for 


help and someone in one of the vehicles next to you in traffic hears your cries. 


The person in the other vehicle calls 911 and describes what is going on, then 


answers all the 911 dispatcher’s questions in detail. 


Imagine that your abductor drives along uninterrupted by even a single police 
car, stops at a local secluded spot, murders you, and buries you in a shallow 


grave, where your body is found two days later. 


This is, very sadly, a real story that took place not too far from where I used to 


live. 


Now imagine someone starts teaching the general public how to escape from 
makeshift as well as readily available restraints. Teaching couples, children, and 
families how to break free of zip ties, duct tape, and rope. And even from 
handcuffs because in the US, handcuffs are not a restricted item and can be 


purchased online with a single click by violent criminals. 


This is my mission. I understand that there are limitations in tools, tactics, and 
training. I also understand that evil people will commit evil. My life’s passion is 
to teach anyone willing to learn about how physical security and its illusions 


work so I can make the world a little safer and a little more prepared. 


CASE STUDY 2: “PROFESSIONAL CERTIFIED 
APPLICATION OF RESTRAINTS” 


When I was teaching a mix of different US military personnel about flex-cuff 
escapes, one of the students (who became a lifelong friend) interrupted me. He 
took the set of law enforcement flex-cuff restraints from my hands and 
proceeded to secure his hands behind his back. He walked his hands from 
behind his back, under his feet, to the front of his body. He then untied one of 
his bootlaces and used it to create a “friction saw,” a flexible tool that when 
pulled back and forth across the plastic restraint will heat the restraint and 
cause it to melt through, which freed him from his restraints in fewer than 20 
seconds. (This is one of the very few times I’ve run into other first responders 


who were competent in restraint escapes. It is a rare find.) 


He explained to me he learned this technique from his time in state law 
enforcement, where he often dealt with rioters and protesters. The protestors 
would hire consultants who would teach them how to use things like bootlaces 
to break free of restraints. This frustrated the riot police, who assumed they'd 


successfully secured the cuffed instigators. 
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Expending a small amount of time and energy in preparation, like lacing your shoes/boots with 550 cord, a.k.a. 
parachute cord, can help you get through several types of restraints. 


I like telling this story to help give the skill set I teach a little more real-world 
depth. It also reveals that the police (the 911) were unprepared for the 
protestors getting free of their restraints. The police learned of the limitations 
of their gear only after realizing, “Hey, I thought I'd already flex-cuffed that 
person twice before.” They repeatedly dropped the ball. 


Youd think that if anybody is going to have expertise in handcuffs and flex- 
cuffs, it would be the only people in this country who have the monopoly on 
the use of force. The people who are qualified in “professional, certified 
application of restraints.” Unfortunately, that is not the case. The reasonable 


expectation does not match reality. 


The police, military, and many government agencies often pay private 
companies to help teach their employees how to do their job better. Something 
to consider when discussing infrastructure and other government-related 


programs. 


LESSONS LEARNED 


Even if you call 911 and answer all the dispatcher’s questions, the 
police might not come and save you. Even if a witness is in a car right 
next to you in traffic, talking to 911 on a cell phone, the police may 
not come and save you. Don’t quit. Be creative. Try anything and 


everything to survive. 


Real criminals escape from real police detention all the time. Law- 


abiding people should also expect that escape is possible. 


I do not think people should be paranoid on a daily basis. There is 
definitely such a thing as an unhealthy level of security awareness. You 
can live your best life and still implement a few security procedures 
and protocols. 
¢ This is why I focus on tools, tactics, and techniques that are 
low-cost and low-impact and that allow people to live almost 


the same life as before implementing security measures. 


I teach people techniques for escaping handcuffs, flex cuffs, zip ties 
and duct tape as well as a tie-up with rope, 550 cord, and other readily 


available items. 


If my teaching restraint escapes to the general public make you 
uncomfortable, let me offer a metaphor: Would you rather run 
through a forest blindfolded and just hope you never smack into a 
tree? Or would you rather have your eyes open and be aware of serious 
security flaws so you can take steps to avoid running blindly and 


smacking into a tree? 


Keeping security information from people does not make 
them safer. Never has, never will. 


Even law enforcement, who are supposed to be not only the leading 
but also the only experts in handcuffs, etc., are not taught on any 


meaningful level the limitations of their gear. 


In my professional opinion and experience, out of all of the things I 
teach people, restraint escapes has the absolute highest return on 


investment, an investment that hopefully you will never need. 


Please learn and practice (safely) some escape techniques and teach 


your loved ones too. 


CHAPTER 19 
GUIDELINE: RESTRAINTS 


DON’T QUIT, YOU HAVE OPTIONS 


In this chapter we will discuss some basic concepts regarding a few select 
restraint-escape techniques and some red flags to consider if you are ever placed 
in illegal restraints by criminals. We'll close with a brief, humorous case study 


from one of my deployments. 


SOME TECHNIQUE OPTIONS 


I keep two different professional restraint-escape tools around my neck, always accessible during training and 


instructing. 


SAFETY 


Anytime youre practicing restraint escapes, there are a few things I 


recommend: 


e Always have multiple professional restraint-escape tools on your 


person during your escape attempt. 


¢ If youre able, have a spotter with you who also has access to 


professional restraint-escape tools. 


e There is a time and place for high-risk training to assess students’ 
abilities to deal with decision-making under stress or on the fly. But 
there will be no surprise attacks, no tricks, no horseplay, 
no “setting up for failure” unless all participants are 
informed and they consent and boundaries are clearly 
set and safeties are in place. Period. 


¢ As an instructor, and as a student, you should understand the 
difference between “I can’t. Fuck it. I failed” and “I’m struggling.” 
They look very similar. 
¢ I often have students that say, “Take these restraints off, I 
cant, I’ve failed” and that is a great time as an instructor to 
double-check with them and to have a very quick discussion 
to remind them that you will absolutely release them but that 
struggling is encouraged and allowed. Offer some pointers 


and some direction if they are interested in continuing. 


¢ I recommend that instructors coach students through difficulties 
instead of “doing it for them.” 
e Example: A student says, “Sir, I can’t get the key into the 
keyhole.” The instructor replies, “Here. Let me just move your 
hand to the right spot.” Not always the most helpful to the 


student. 


¢ Better option: A student says, “Sir, I can’t get the key into the 
keyhole.” The instructor responds, “Remember how to first 
locate the keyhole with your finger and then to replace your 


finger with the key? Try to visualize it. You are so close. Don't 


forget to explore up, down, left, and right with the tip of the 
key. You want to use a systemized approach to searching for 


the keyhole.” 


HANDCUFFS 


A shim technique works really well on most brands of handcuffs, as long as 


the they’re not double-locked. Create a makeshift shim tool by folding and 
creasing a barrette until it separates into two pieces (see photo 1, above). Push 
the tool as far as possible into the housing of the handcuff face (photo 2). At 
the same time as you push in the tool, push in the movable bale (photo 3). 


Once set, leave the tool wedged deep into the housing and pull out only the 
bale, opening the handcuffs (photo 4). 
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open handcuffs through the keyhole with a bobby pin or other tool. The photo 
above (top) shows a bobby pin bent into shape to be used as a pick and, next 
to it, an unmodified bobby pin. You see (bottom photo, above) that if the 
handcuffs are not double-locked, this technique is as simple as inserting the 


tool and lifting just one lever (colored red in this training cuff). 


FLEX-CUFFS 


(1) A standard law enforcement flex-cuff and, next to it, a barrette separated in half to form a makeshift shim 

tool. (2) The tip of the barrette sliding into the locking mechanism (shown from inside the flex-cuff loop). (3) 

The shim tool fully in position, separating the teeth-shaped halves of the locking mechanism and loosening the 
flex-cuff: (4) The shim tool sliding into the locking mechanism (shown from outside the flex-cuff loop). 


The shim technique can work on many (not all) types of flex-cuffs. You simply 
separate the top and bottom “teeth” of the locking mechanism. But beware: If 
you have to tighten a restraint in order to get better leverage to slip in a shim 

tool, you need to be prepared for failure and dealing with the consequences of 


a tightened restraint. Train safely and weigh your options. 


550 cord is not only a reliable shoelace but also a great escape tool you can always have with you. 


The friction-saw technique is a favorite with many of my students. 550 cord 
(parachute cord) is a really good option for something to “saw” back and forth 
over the same spot on a flex-cuff. You're basically heating the plastic flex-cuff 
from the friction produced by the sawing motion. After only a few seconds of 
pulling a section of the flex-cuff tight while rapidly sawing across it, the plastic 


will start to melt and give way. 


The shim and friction-saw techniques are by no means an exhaustive list of 
restraint-escape options. A goal here is to dispel the illusion that once you are 
placed in restraints you are stuck forever. Handcuffs haven't undergone a 
significant design change in more 100 years; they are not difficult to 


understand and defeat. 


RED FLAGS: RESTRAINT BY CRIMINALS 


If someone threatens my life or they threaten me with serious bodily harm, I 


take it seriously. 


As soon as someone puts their hands on me (in a way other than friendly) 
they have violated my sovereignty and escalated the level of seriousness of the 


situation. That will be dealt with accordingly. 


If someone has me in “checkmate” and demands that I be placed in 
restraints, [‘ve come to terms with the decision to fight to the death rather 
than allow myself to be placed in an even more helpless situation. If the intent 
was to kill me on the spot, there would be no reason for restraints; the murder 


would have already happened. This is a sign that fighting is worth it. 


Whether I’m in restraints or not, if ?m outnumbered, if ’m cornered, if I’m 
already in “checkmate” so to speak, and my attacker demands that I be 
removed from one place and taken to another, I’ve come to terms 
with the decision to not be transported somewhere more of a threat to my 


chances of survival. I will fight to the death first. 


You don’t want to dig your own grave. That is a red flag. Consider seriously 
when someone tries to put you in restraints, orders you to place yourself in 
restraints, or attempts to take you from one place to another against your will 


in a violent situation where your survival is at stake. 


This is not a martial arts book. This is not a combat book. But if some sort of 
criminal element is demanding that I be placed in restraints and/or transported 
from one place another, the fight is going to start and end in that very spot. Of 


course, you absolutely have to make up your own mind on the matter. 


RESTRAINT-ESCAPE CASE STUDY: CALCULATED 
DECISIONS 


A good friend and mentor of mine, JP, allowed me to use and abuse him as my 
training dummy quite a bit during our overseas deployments. As the Team 
Leader for our eight-person, counter-narcotics detachment, he very much 
supported our personal and professional development, even at his own 


expense. 


My friend and mentor, JP. during restraint-escape training drills. 


Our detachment was stationed on a British ship for a two-month tour. It was a 
huge-ass ship. Huge. It had multiple floors above and below the waterline and 
was about two football fields (645 feet) long. 


When our detachment wasn’t operating, we were either drinking heavily or 


training. Or sometimes both. 
This time was both. 


It was near the end of our deployment. We were in the bar onboard the ship 
and we were all lit. We stood beers in hand, laughing and making fun of what 
a complete joke this “drug war” was, when we all fell silent. Seven of us were 
making eye contact, with JP being the odd man out. You could see the wheels 
turning in his head as he tried to figure out why no one was looking at him. 


You could also tell the moment he caught on. 
He stepped quickly toward the door. 


If I remember correctly, all seven of us dropped our beers and tackled JP. For 


some reason, I remember JP not dropping his beverage...ever. Bravo, friend. 


Someone produced a pair of handcuffs and we cuffed JP behind his back. For 
more of a challenge, we double-locked the handcuffs. (Keep in mind that JP 
was a willing participant. I would never do something like this to someone 
who hadn't already given their consent to be tackled and restrained. Every 
participant in this exercise was informed and had given consent, even though 


the timing was a surprise.) 


We stripped JP down to his underwear while he drunkenly tried to headbutt 
and bite us, and we told him: “We're going to give you a 30-second head start, 
and if we find you and you are not out of those restraints, there will be 


consequences!” 
He bolted out of the bar. 


We searched for him for about 20 minutes, in terror that he was going to jump 


out of a corner and pummel us to death. After about 30 to 40 minutes we 


started wondering if he was still alive. 


After an hour, we'd given up and ended up back at the bar (one of three bars 
on the ship, the US really does things piss-poorly compared to our foreign 


allies), singing karaoke to some AC/DC classics when JP strolled in free of his 
handcuffs. 


We asked him where the hell he'd been, and his response was beautiful: “I was 


in the only place you guys didn’t look, you fucking animals!” 


He continued: “I knew you wouldn’ interrupt operations on the bridge, so I 
ran up there and hid in a dark corner. I stole about 30 paperclips from one of 
the desks, and crouching in my underwear I went through about 29 broken 


ones before I was able to get those fucking handcuffs off!” 


We laughed. We applauded. He told us, “Yes, it was embarrassing! But these 
Brits are some all-right dudes. The two guys up there steering the ship said, 
‘OI, mate, you seem a little lost,’ and I said “Nope! I’m not lost, just doing 
some training, don’t mind me.’ They minded their own business and I minded 


: ” 
mune. 


This is a drunken tale, but I really like two things about how it ended: (1) JP 
never gave up. I sincerely admire him for that. (2) JP was resourceful to a fault. 
He used the best tactic and the only tools he had available, and he outwitted 


all our drunken asses. 


CONCLUSION 


This by no means is a complete list of restraint-escape techniques. I teach the 
use of more than a dozen different tools and methods for escaping handcuffs, 
flex-cuffs, zip ties, duct tape, and rope/cordage. I also emphasize that just 
because you've run down your list of known techniques and none has worked, 
that does not mean it’s time to give up. Be creative, cheat (in an emergency), 
think outside the box, exploit your environment, and use every possible 


resource you Can. 


I don’t recommend getting hammered when practicing high-risk training. I 
was a younger man when I served with JP, and today I would not get involved 
in drunken training. In fact, I hardly drink at all anymore. I’m here to share 
my failures and my faults with you, things I have learned from and hopefully 


things you can learn from as well. 


CHAPTER 20 
GUIDELINE: TARGET 
ASSESSMENT 


THE HEART OF THIS SKILL SET 


I reserved this chapter for later in the book so you could get an organic sense of 
the order of operations that worked in the field (and sometimes didn’t) before I 
presented my methodology’s official template. Sort of like having you “feel” 
your way into the curriculum through experience and then presenting the 
template rather than presenting the template and having you try to shoehorn 


every action into it. 


I almost gave this book the title Tactical Lock Picking, Volume 1: Target 
Assessment. This topic, the methodology and framing of this skill set, is that 


important. Here’s why... 


One of the problems I’ve commonly seen with expensive-as-shit professional 
courses and with many training videos and books is they don’t take into 
account failures and field application. You must include both if you're 
going to teach people how to apply this or any skill set in the field. 


If you're teaching people how to use firearms for combat or self-defense and 
you don’t ever mention(!) what to do when a gun jams or misfires, not only are 
you setting them up for failure but you're also neglecting to correctly shape 


their training, which could lead to their death. 


Fun Fact: As a student of a TEES course (energeticentry.com), | really 
appreciated this gem from the staff: When bombarded by ignorant people 
saying, “I carry a shotgun in my car, I'll just shoot through the door! Whoo!” 
the staff explained (I’m paraphrasing), “Yeah, and you’ll end up shooting a 
child in the head on the other side of the door, and none of us will support 
you then.” The staff went on to explain the science behind the different types 
of specialized rounds for shotgun breaching and the reasons you must be 
well-trained and well-informed and use the safest possible options for entry. | 
also appreciated that they understood failures and helped us prepare for and 
avoid them in the field. 


Also, for a first-responder, mechanical-breaching course (using battering rams, 

pry bars and shotguns, etc., to force open doors in an emergency), failures play 
an important role too. If you teach people that all they need is one tool, which 
will always work, you'll likely set them up for failure or even death, let alone 


the death of those they've been called upon to help. 


Now let’s delve deeply into how Target Assessment works. I'll discuss the seven 
steps I utilize on scene in my decision-making process, provide a simple 
training drill I practice regularly, and cover a few additional topics associated 


with Target Assessment. 


First off, ’ve developed a mnemonic device for all you weirdos like me out 
there. If youre just beginning to form your base-level skill set or you're ever 
stuck on scene and need to reassess your options, this mnemonic can help you 
recall the Tactical Lock Picking—Target Assessment steps to give your entry a 


strong flow. 


I figured the more inappropriate the mnemonic was, the easier it would be to 


remember: 


My — Sister — Always — Makes - The — Noisiest — Orgasms 


Moral Right for Entry 
Speed/Level of Urgency 
Attack Vector Identification 
Manual Unlock Check 
Tool Availability 

“Now or Later” 


Other Resources 


The better you understand the flow of these steps, the better you'll be at your 
decision-making process and the better you'll be able to direct others on scene 


before or once you arrive. 


TARGET ASSESSMENT STEP 1: MORAL RIGHT FOR 
ENTRY (MRE) 


(My — Sister — Always — Makes — The — Noisiest - Orgasms) 


Let me hop onto and then right off of the soapbox really quick...just because 
something is “legal” or “authorized” does not mean you should do it. And just 


because something is “illegal” or “not authorized” does not mean that you 


shouldn't do it. All done. 


You'll notice I use the word moral more often than the word /egal. While I 
don’t want any of you to get thrown into jail, I don’t encourage you to live 
your lives based on rules some idiot behind a desk pulled out of thin air. That’s 
how Jews ended up in gas chambers...when was it, in the 1940s? Yeah. Not 


too long ago. 


Fuck, I got back on the soapbox again. Well, “sorry, not sorry.” Moving on, I 


promise! 


Let me give you an example of “authorized but shouldn't.” Most places 
of employment (damn near all of them) have a policy allowing a search of your 
locker or your office without permission from you, the employee. Let me crush 
the fallacy that this is justified. Do you want people thumbing through your 
wallet and your underwear inside your locker at work while you're in a shower? 
The answer is no. Or at least it should be no. But let’s say you're fine with it, 


and let’s change it up a bit. 


Let’s say your police or fire chief had to approve the policy. Do you think they 


want some young rookie strolling into their office and digging through their 


file cabinet or locker or inside their vehicle because “all employees are subject 


to search, etc.?” No, they probably would not. 


If you put your private things somewhere and you put a lock on that space—a 
lock for which only you have the key or the access code—you have an 
expectation of privacy. While there may be authorization for such spaces to be 
searched, it would be terribly poor practice to do so without a morally sound 


reason. 


Conversely, “illegal but should.” Let’s say you're in a park. Maybe you 
made a wrong turn but somehow you got into the park without paying your 
entrance fee. You suddenly feel the onset of explosive diarrhea, and you tippy- 
toe-run to the nearest restroom. The door is locked, though you've knocked 
and no one has answered, so you've confirmed the restroom is empty. Your 
First-Line Gear picks are in your wallet. Is it reasonably moral of you to pick 
your way through the seven-dollar door lock? You can put me on record 


saying, “Yes, I would make that entry and lose zero sleep over it.” 


Many times the rightful owner of a property or a vehicle will be present on 
scene with you. That makes MRE easy. What isn’t always easy is identifying a 
rightful owner who can legitimately permit you entry, especially when it comes 
to things like shared spaces and people that demand entries based on their title, 


rank, or position. 


If you're in a shopping center’s outdoor parking lot where it’s 110 degrees and a 
mother is trying to get her toddler out of a locked car (the keys are locked 


inside), it’s obvious who the rightful owner is who can grant you entry. 


Pro Tip: If the rightful owner is present, be sure to ask, “Are you giving me 
permission to make entry knowing | may cause damage, though that’s not 
likely? Are you agreeing to let me attempt an entry and will you hold me 
blameless if any damage occurs?” Scratching the paint on a vehicle when 
attempting entry is especially common. For most people that’s not a big deal, 
but for some it could be a touchy subject. 


Let’s say someone of a higher rank or position than you asks, “Hey, lockpicker, 


I need you to open this room.” 
To which you respond, “Oh, don’t you have a key for that?” 


Their reply should tell you something. If they say, “Well, no, I don't have a key, 
but... need to get in here for work,” you can always respond, “Hmm... 
welp...I’m sorry but I definitely don’t have the right tool for that. Do you want 
me to call [Human Resources, their boss, etc.] and let them know you lost 


your key and I was unable to break in for you?” See how that plays out. 


Just because someone is your boss or they are “a” boss doesn’t mean they have 
the authority they wish they had. You can always deny an entry if you don’ feel 
right about it. 


In all my years of self-guided study and professional schooling, I’ve never heard 
anyone present a complete Target Assessment system in any clear fashion (or at 
all, TBH.) When using this or any powerful skill set, the first thing you should 
do is figure out if what youre doing is morally right. 


TARGET ASSESSMENT STEP 2: SPEED/LEVEL OF 
URGENCY (LOU) 


(My — Sister — Always — Makes — The — Noisiest - Orgasms) 


Even with the simplest entries it helps to know how soon they need to happen. 


This is subject to change rapidly and should always be reassessed. 


Broadly, when it comes to Speed, there are three Levels of Urgency to 


consider. 


Administrative: When you have all fucking day, your LoU is Administrative. 
Administrative here means there’s no risk to life or limb. Also, there’s no likely 
chance of a deteriorating circumstance (see “The Quicker the Better”). A 
common example is a lost key for a rarely used storage cabinet. I’m sure you 
can figure out that with this one, if your EDC or First-Line Gear has a chance 
at opening the locked obstacle, you might as fucking well give it a shot for a 
few minutes. After about 10 minutes, if you aren't making progress, you can 
bring your happy ass back with your Second-Line Gear later in the day or the 


following day or whenever. 


Example: “I’ve got to start tidying up my shed out back, but | lost the key for 
the padlock...Hmm. | should take a crack at that sometime this week with my 
pick set.” Very, very Administrative. 


The Quicker the Better. When your LoU is The Quicker the Better, you're 
not yet in the realm of Right Fucking Now. Here in this midlevel is where I’ve 
spent most of my time as a practitioner of this skill set, and you probably will 


too. 


You can also think of this level as We're Okay for Now. A good example is the 
case study “Closed Park.” The gentleman stuck behind the gate had no illness 
or injury and wouldn't have gone hungry if he'd had to sleep in his car 


overnight, and there was nowhere he had to drive in order to save someone’s 


life. 


An example of the quicker the better is the case study “Broken but Not 
Dying.” While we had no change in medical status and we had no loss of 
consciousness, we were in this medium Level of Urgency. If the elderly woman 
in that situation had stopped verbally responding to us and if we'd been unable 
to contact her by phone, we would have escalated our Speed/LoU to the level 
of Right Fucking Now. There was a clear possibility of deteriorating 
circumstances. Everything you do en route to a call as well as once you're on 


scene must constantly be reassessed. 


Right Fucking Now: The highest LoU is when you need to get in somewhere 
Right Fucking Now (technical term). Lives are on the line and seconds 
matter. You're now in the destructive-entry range of the TLP spectrum. You 
should probably consider utilizing a glass punch on a pane of glass, kicking in 
a front door, or using a sledgehammer or that boot of yours to attempt a quick 
(and safe) forcible entry. Example: My house is on fire and I’m trying to 
evacuate my family. I reach my nine-year-old daughter’s room, and for some 
reason her door is locked though I can hear her screaming inside. It’s time to 


force that fucking door in, ASAP. 


TARGET ASSESSMENT STEP 3: ATTACK VECTOR 
IDENTIFICATION 


(My — Sister - Always — Makes — The — Noisiest — Orgasms) 


When attempting to open a padlock on a fence or gate, start with a close 
inspection of the padlock and then expand outward in search of other Attack 


Vectors, for example: 
¢ attacking the keyway by picking or using a keyway bypass 
e shimming the padlock 
¢ bolt-cutting the shackle 
¢ looking above, below, and around the padlock for a furniture bypass 
¢ using a screwdriver to unscrew the latch where the padlock hangs 


If you're trying to gain entry into your standard residence, you'll probably start 
at the front door. Just as in the case study “Rescuing Man and Man’s Best 
Friend,” you quickly identify your Attack Vectors by sight: the hinges, the top 
and bottom locks, the bottom latch. 


For a vehicle, you can look for a keyway (though more and more vehicles have 
fewer keyways). Also, examine the doorframe for any obstacle to an entry 


attempt using an airbag and a reach tool. 


TARGET ASSESSMENT STEP 4: MANUAL UNLOCK 
CHECK (“TRY ONCE, TAKE A DEEP BREATH, AND 
TRY AGAIN HARDER") 


(My — Sister — Always - Makes — The — Noisiest — Orgasms) 


Once you have your MRE and your Speed/LoU and you are on scene (or 
directing from a distance) and you've identified different Attack Vectors, you'll 


start with the first physical step in your entry: try the lock to check if it’s 
unlocked, take a deep breath, and try again harder. 


Experiment: Try this at home on an interior push door (a door where you 
operate the handle, then push the door away from you to open it). Make sure 
no one is on the other side so you don’t injure anyone. With the door closed 
and unlocked, use a light amount of tension to twist the knob open until the 
latch is fully receded into the door, then gently push the door open. If this 
works, close the door again, take a deep, wide stance, and use your shoulder 
to push forward into the door with a lot of force. While continuing to push 
with force, again use light tension to twist the knob. Notice any difference? 
There’s a good chance the knob will be much harder to turn because of the 
amount of friction now applied to the latch. This is caused by the latch being 
pushed up against the latch strike plate. 


A Manual Unlock Check often works on loose or inexpensive doorknobs. It 
also tends to work on doors that are under a lot of pushing or pulling pressure 
while in the closed position, frequently due to aging, weathering, or improper 


installation. 


Be aware that a residential front door that has a deadbolt and a doorknob, both 


with keyways, might only be deadbolted while the bottom doorknob remains 


unlocked. Always check and double-check whether doors are truly locked, 
including both top and bottom locks. 


The same applies to windows. Push or slide a window in an attempt to open it, 


take a deep breath, and try again harder. 


TARGET ASSESSMENT STEP 5: TOOL AVAILABILITY 


(My — Sister — Always — Makes — The — Noisiest — Orgasms) 


After you've identified any available Attack Vectors, you'll need to know which 
tools you could use on them. Sometimes one Attack Vector (like a keyway) can 
utilize many different tools, all of which have different pros and cons and 
possibly different amounts of time they are likely to require to achieve a 


successful opening. 


You need to know which tools are currently on your person, in your First-Line 


Gear. 


You also need to know which tools are available in your Second-Line Gear and 
Third-Line Gear, so become familiar with the tools you carry routinely and 


have organized into your deployable setups. 


Additionally, you need to be aware of tools not on scene with you that you 


could get or have brought to you. 


And dont forget to be on the lookout for anything in your environment you 


could use to makeshift into a tool. 


Pairing this Target Assessment step with the next is where even more magic 


happens. 


TARGET ASSESSMENT STEP 6: “NOW OR LATER” 


(My — Sister — Always — Makes — The — Noisiest — Orgasms) 


This step is where we determine our Attack Timeline, which tells us if we 
should pause our assessment and attempt our entry now or search for and 
weigh other options first, continuing to assess before applying tools to an 


attack vector. 


Defined: The Attack Timeline is the math equation and subsequent solution for how long 
it would take to put a specific tool in play for a specific Attack Vector, added to an estimate 
of how long it would take to achieve entry. 

Once I examine an Attack Vector, I work out, for example: “Do I have the tool 


to access this lock? If not, how long would it take to get that tool and bring it 
here?” I add, “How long do I estimate an entry would take once I have the tool 


with me on scene, at the ready?” 


I assess the Attack Timeline solution through the filter of seconds, minutes, and 


hours: 


e If the Attack Timeline solution is, “Ir ll take me a few seconds,” I 


usually start the attempt right away. 


¢ If the Attack Timeline solution is, “It'll take me a few minutes,” I may 


or may not start the attempt right away. 


¢ If the Attack Timeline solution is, “It'll take me close to an hour or 
more,” I definitely will keep assessing my options and start looking for 
additional resources before committing to an hourlong or more entry 


attempt. 


Quick Reference: For something like a Plus-One Method attack for a four-digit 
combo lock, if | attempt one combination every second, to try all 10,000 
entries it would take me a maximum of 2 hours, 46 minutes, and 40 seconds. 


You don’t have to get too caught up in numbers in real life. There’s usually no 
need to sit down with a pen and paper and calculator to try to figure out 
multiple equations and to weigh them against one another for slightly different 


tools, especially when youre considering seconds and minutes. 


Where the Attack Timeline really comes in handy is using it to figure out 
whether it’s worth driving 20 minutes to a local hardware store and 20 minutes 
back for a pair of bolt cutters to attack multiple three- and four-digit combo 
padlocks or whether it’s worth trying to open just one three-digit combo lock 
when, based on your simple math, it would take fewer than 15 minutes to try 


every possible combination across the three dials of the lock. 


If, after your pairing of an Attack Vector and an Attack Timeline, you decide 
not to start your entry right away, finish your Target Assessment by completing 
a full or partial perimeter check and weighing each Attack Vector you come 


across. 


TARGET ASSESSMENT STEP 7: OTHER 
RESOURCES 


(My — Sister — Always — Makes — The — Noisiest - Orgasms) 


Scouting out additional resources is completely on you. This step is absolutely 
unlimited. You get to put the icing on the cake and decorate it however the 
hell you choose. Important, and included in this step, is also to breathe and 


reassess all of your progress so far to see if you've missed anything. 


Thinking outside the box, being creative, and even cheating in an emergency 


situation are encouraged; just make sure you do what is morally right. 


OTHER RESOURCES 


Here’s a list of tips to start with; you should always be adding to it: 


Does the Two-Step Rule apply? Is there a hidden key or code nearby? 


Does Same Lock, Same Key apply? Can you learn something from 


your environment or from a lock you've picked open before? 


Can you makeshift a tool from your environment? 


What can you do with your smartphone? 


Search for an installation manual for almost any make/model 


lock, mechanical or digital. 
Search for a manufacturer's default combination or key code. 


Search for relevant information to help you socially “de- 


engineer” your way through a combo lock or keypad. 


Search for videos of people whove probably picked open the 


same make/model lock youre dealing with. 
Call a locksmith. 
Call a friend for ideas. 


Email me (Uncensored Tactical@gmail.com). 


Here’s what you can use other people on site for: 


e Bounce ideas off them. 


Recruit them to try to pick a lock or attempt a bypass. 


Have them do a walkaround of the property while you try to access 


the main entry point. 


Have them check the immediate area for a hidden spare key. 


Ask them to find out if there is a keyholder and, if so, to contact that 


person. 


e Ask them to hold a flashlight for you (if you didn’t take my advice and 


include a headlamp in your Second-Line Gear). 


Send them to find materials nearby that you can use. 


Send them to buy items nearby that you can use. 


e Ask them to get your Second-Line Gear bag for you while you start 
working with your First-Line Gear or EDC items. 


If they're breathing down your back or distracting you, you can tell 
them to go grab an item from somewhere far away. (This is actually 


very common in the field and you should definitely try it.) 


Remember that in an emergency, its better to mobilize all your options and to 
cancel them if you gain a successful entry and dont need them than to wait until 


failure to start to consider other options. 


BREATHE 


For the firearms enthusiasts out there, no, this is not like “breath control,” 


where I tell you to take slow, steady breaths while performing your techniques. 
This is an important step in troubleshooting and an important step in life too. 


It doesn’t matter whether you are struggling with an entry attempt, with 
multitasking, with math, or with finding another way in, out, or through. Your 
environment is speaking to you and telling you it is time to take a figurative 


and maybe a literal step back. Remove your tool(s) from the lock, stand up 


straight, and take a deep reset breath. 


Just as we don’t frown upon failures (mentioned in our dedication on the first 
page of this book), we don’t frown upon making the smart, conscious decision 


to recalibrate that big, sexy brain of ours. 


Even casual “hobby lock pickers” may be familiar with this situation: “I was 
picking and picking and picking and just could not get that padlock to open! I 
removed my tools, took a deep breath, and then put my tools back in and bam! 


Popped right open!” 


Please be on the lookout to use that supercomputer in your head. Listen to 
your environment. Stretch that creative-brain muscle. And remember that 
while not giving up is encouraged so is taking a step back to recheck your work 
and to recalibrate your brain so you can attack your obstacle with renewed 


vigor. 


REASSESS 


Things to consider: 


What is my LoU? (This may change often or rapidly.) 

Do I have permission? (This shouldn't change much, but it might.) 
What tools do I have on hand? 

What tools can be brought to me? 

What tools can be purchased nearby? 

What tools can I source from the environment? 

Are there people around who can help me? 

Do any people on scene have an entry skill set? 

Can I call on outside help (locksmith, breachers, keyholders, etc.)? 


Is it faster for me to get a different tool or to continue trying this 


technique? 


Have I inspected the locked obstacle from every possible angle? Have I 
checked for an unlocked padlock out of view? 
¢ Be sure to look above, below, to the left, to the right, behind, 
and at the front of each obstacle. 


Is the environment changing? How will that affect me? 


e Are new shift workers arriving soon? Could they be bringing more 


assets? 
¢ Is trying a certain technique damaging my tools? 
¢ Could my tools get stuck inside this obstacle? 


¢ How long will I spend on this attempt before using a different tool, 
different technique, different Attack Vector, etc.? (Here’s where you 


draw your Line in the Sand.) 


PRACTICE DRILLS 


One of the best ways to begin to understand Line in the Sand is 
with a few simple padlock-training concepts: 


1. One lock, many lock-pick sets: A padlock you know you can open. 
Maybe not the easiest but one you can open most of the time. Lay out 
a few different lock-pick sets (each set usually includes one tension 
wrench and one rake) and maybe some bypass tools (like commercial 
shims if the padlock will allow a shim attack). Give yourself this 
mission: “I will attempt to open this padlock with every different pick 
set I have here. I will try for an extended period with each tool and 
exhaust all possible techniques using it. If I open the lock with a set, I 
will put that set aside.” Work your way through the various pick sets, 
and feel how each tool is different. Understand how different tension 
wrench selections and positionings can affect your raking or picking in 
the keyway. Most important, you will start to internalize the 
economics of how long you should try a tool and a technique before 


trying something else. 


2. One lock-pick set, many locks: Select one lock-pick set and a handful 
of different padlocks. Again work until failure. If you pick open a lock, 
set it aside. If you fail on a lock, set it aside for a second attempt once 


youve worked through all the locks. 


3. Combined exercise: Lay out the same few sets of lock picks and the 
same padlocks. Now you get to throw in all the variables you like. The 
mission: “As fast as I can I will open every single one of these padlocks 
using whatever tool/technique and in whatever order I think will be 


the fastest.” If you take more than a few seconds opening a lock, you 


can either struggle or switch tools or you can set the padlock aside and 


move on. 
Playing with the basics is all that an advanced skill really requires. 


These three drills should help you start to gauge when to push through a specific 
approach and when to move on to something else. You should always be 
reassessing your entry options and flexing your creative-brain muscle. If it’s 
stupid but it works, it ain't stupid! And remember: TLP is not an exclusive skill 
set. I do not tell people, “No, you shouldn't try that tool or that technique or 
that shortcut.” In this skill set, creativity, overkill, shortcuts, and cheating are 


all allowed and encouraged. (As long as you maintain your MRE, of course.) 


YOUR ENVIRONMENT SPEAKING TO YOU (OR 
WAVING FLAGS) 


Some things will start to speak to you, as they speak to me, on scene: 


Door-latch guards often tell me the gap in a door is too wide and 


therefore susceptible to a latch-slip attack. 
Gaps under doors tell me that an under-door-tool attack might work. 
Handles on doors also tell me that a UDT attack might work. 


Gaps between double doors tell me I can probably use a double-door 


tool to reach through and activate a crash bar to unlock the doors. 


A house with a private front porch or private walk has a higher 


likelihood of a spare hidden key. 


Combo padlocks often have the damn code written on the back or 


sometimes nearby. 


Combo locks sometimes will be left on a certain dialed-in number— 


for a reason. 
Pedestrian gates will often have a “push to exit” button. 


Buttons opening handicap doors will often override locked doors that 


are programmable to open automatically. 


Just as with many other skills and professions and with life in general: Your 


environment is speaking to you. Keep an open mind and learn how to listen. 


TARGET ASSESSMENT OFF SCENE 


Here’s how you might handle Target Assessment without even getting off your 


couch. 


Friend: “Hey, I’m locked out of my office building. [The friend owns the 
building.] Can you help me?” 


Tactical Lock Picker: “Sure. Are you at the front door?” 
Friend: “Yes.” 


Tactical Lock Picker: “Take a photo of the entire front door and then a closeup 
of each lock on the door and of the door jamb. Send those photos to me.” 


Friend: “Will do.” 
The friend sends photos. 


Tactical Lock Picker: “Okay, there are some possibilities here. First, try pulling 
and pushing the door handle really hard a few times just to make sure we're 


not crazy.” 
Friend: “Sure. Okay, definitely locked.” 


Tactical Lock Picker: “Take a walk around the property and try each door and 
each window in case any are unlocked. Put some elbow grease into it! And 


send me photos.” 
The friend sends more photos. 


Friend: “None were unlocked.” 


Tactical Lock Picker: “All right, do you happen to have a metal coat hanger in 


your car or can you ask someone for one?” 
The friend finds a coat hanger. 
Friend: “I’ve got a coat hanger here. What do you want me to do?” 


Tactical Lock Picker: “Loop it around the latch within the door frame and 
pull.” 


Friend: “Oh shit! We’re in! Cool!” 


This could have ended a hundred different ways. But what I want to point out 
is that the better you understand your flow (My — Sister — Always — Makes — 
The — Noisiest - Orgasms) and the options an environment offers, the better 


you can teach and direct others. 


CONCLUSION 


Through all the case studies presented in this book, demonstrating field 
application in many different environments, I hope you've started to see how 
Target Assessment can take shape. You are allowed to skip steps; you are 
allowed to alter your order of operations if it makes sense for you to do so. 
Your Target Assessment can start, and end, even before you arrive on scene. 
And again (broken record) you should always reassess your progress and your 


options. 


Pro Tip: After you make a successful entry (or even if you don’t, especially if 
you don’t) you should document the case. It’s up to you how much effort to 
put into it, but photos of the front, back, frame, and latch of any door you 
unlock are of huge value. Videos of your successful entry (even if re-created) 
are also very valuable. A short writeup will benefit you and your students if 
you decide to teach others. 


I wish I had more photos from the original scene of a case study, as opposed to 
re-creations, to show in this book. But I’m always learning as well. Failing to 
do something can encourage you to better your performance. I now have, built 
into my curriculum, tasks for students in the course to use their phones to take 
photos of each lock they pick open and which tools they use for it throughout 


the course. 


And dont be afraid to fail. 


CHAPTER 21 
GUIDELINE: THE FIELD IS NOT 
YOUR COUCH 


THE FIELD IS RESULTS-BASED 


I dedicate an entire guideline in my curriculum (and in this book) to explain 
to students that there is a huge difference between classroom learning and field 
application. I use the phrase, “The field is not your couch,” to remind students 
to always be ready for unique field situations. They should work this guideline 
into their training and their gear setup so they can be more successful in the 


field. 


Picking a lock through a fence at night with gloves on. 


In this chapter we will highlight how different your hobby picking and your 
classroom training may be from field application. We'll also discuss anchoring, 
positioning, lighting, and gravity—factors that may not present a challenge 
when youre dabbling on your couch and that aren't often addressed in most 


training programs out there. 


THE COUCH 


The field is not your couch! A less-than-one-minute opening on your couch is a 


more-than-ten- minute opening in the field. 


It doesn’t matter if you are on your couch or any other spot where you're at 
leisure. Your lock-pick set could be on the sink next to the toilet. There’s always 
perfect lighting and then some. The A/C is pumping. Maybe some soft jazz is 
playing in the background. One of the best things about this “couch” setup is 
you get to sit your fat ass in the most comfortable seat available. You also can 


choose the height where you want your lock, and your head and your hands. 


You can even choose to use a mechanical vice. An advantage of picking a lock 
secured in a desk-mounted vice is that you get to take all the play/jiggle out of 
the lock. You also get to be bad-mannered and rest your elbows on the table 


while you work on those fine-motor skills. 


Your tools? You can lay out a// your available tools and have however-many 
bins you want dividing your tension wrenches from your hook picks from your 
rakes...take that up to whatever OCD level you like. I usually prefer an arc- 
shaped array of the tools I'll likely need to pop open whichever lock I’ve 


chosen for the day’s training. 


And the locks! I can choose to pick open a deadbolt, doorknob, padlock, and 
all their variants. If I haven't progressed fast enough with the lock I’m currently 


attempting, I can just set it aside. 


Plus, I don’t ever have to switch hands or pick upside down. And if a tool falls 
out of a lock and to the floor, there’s a damn good chance I'll find it... 


eventually. 


This is great! It really is. I mean, who the fuck wants a skill set or a hobby they 
cant practice while drunk on the couch binge-watching TV shows? I mean, 
you could take that combat-weapons hobby to your couch...I don’t 
recommend it, but in the words of a wise friend of mine (my former crew 
leader, from Guantanamo Bay), “You can try anything...once.” (He says this 


with much more wit and timing than I do.) 


The field, however, is not your couch. What we discussed about hobby lock- 
picking in the chapter “What Tactical Lock Picking Is and Isn't” still applies. I 
think hobby lock-picking is fantastic and I encourage it. But I don’t want you 
to forget that the proverbial “couch” is where you can practice drills, but the 


field is where you learn your lessons. 


ANCHORING 


A word on vices. Sometimes people mount a lock or just the lock core into a 
vice to pick it open. There are benefits to this. First, it takes all the play out of 
the lock, which is great. It allows you to focus only on applying the perfect 
amount of controlled tension and to easily rake or effortlessly maneuver your 
pick to each pin and decipher the beautiful kinetic code trapped within each 
different lock. Another huge benefit is that with a vice you can learn things you 
otherwise would have a hard time learning in the field from rusting and loose- 
hanging padlocks. While vices can be used as a tool to help you learn, IMHO 
they are to Tactical Lock Picking what indoor shooting stalls are to combat 


force-on-force training. 


What don’t I like? During a tactical discussion on scene, I don’t want you to 
have to say, “Well, I can usually pick these in my vice at home. I don’t know 
what's the matter with me today.” The wrong use of a vice can set you up for 
failure and I don’t want that. If youre going to use a vice, you have to know 
what youre using it for. A vice can be used to help you pick a higher-security 
level of padlocks because it allows you to focus only on those fine-motor skills 
but it also keeps you from having to troubleshoot many issues that commonly 


arise in the field. 


How do we resolve this vice issue? We anchor. You don’ need to try this 
experiment, just think about it for five seconds: If you had to take apart a 
watch and put it back together with a high degree of precision using a 
magnifying glass and a pair of ultrafine tweezers, would you stand at arm’s 
length from a desk with your elbows locked and your hands in the air? Or 
would you sit very close to the desk and rest your elbows, forearms, and 


probably the heels of your hands on the desk while hunched over a magnifying 


glass like a surgeon operating on a tiny person? Hopefully, for all watch 


owners, youd choose the latter. 


(It just hit me that for some of my readers, and for even more of them in the 


future, I have to explain that watches used to be made with cogs, wheels, gears, 


and tiny springs.) 


Some doorknobs jiggle quite a bit because of age, weathering, or shitty 
construction. If you're in the field and you start hearing that annoying jiggling 
of the door handle while you're raking, it’s your environment speaking 
to you. You may be losing all your progress with your raking technique 
because the pins may be bouncing a little too much within the lock. When 


youre hands aren't “anchored” to anything (see top photo, page 229), you have 


very little control of your tools and the door handle is able to jiggle quite a bit 
with the movement of the tools. Try using one of your hands to secure the 


knob from shaking (bottom photo). 


Also, you want to avoid holding a padlock and your picks separately so they're 


likely to jiggle (see top photo, above). Try to anchor one hand securely around 
a padlock and flush up against the furniture it’s mounted on, and use the other 
hand to pick or rake it (bottom photo). This takes a lot of the excessive motion 
out of the padlock and helps you focus on fine-tuning your picking and raking 
and applying tension. 


You can anchor more effectively by keeping your eyes level with the lock or by 


placing one side of your body up against a door or wall. Operating your tools 


at the level of your bellybutton or your waist is also a good way to optimize use 
of your fine-motor skills. (Think reloading your pistol close to your body or 


opening a pickle jar in your belly area.) 


POSITIONING 


anchoring and securing the padlock if you can. I use many methods of hand positioning in the field, but this is 


usually my starting option. 


If we are at all concerned with achieving a successful penetration, we've got to 
start with the hands. I highly encourage you to—in much the same way as the 
late, great Bruce Lee—“Research your own experience. Absorb what is useful, 


reject what is useless, add what is essentially your own.” 


I start every single class with this 60-second crash course: I show students how 


to hold a padlock in one hand and use the pointer finger of that hand to work 


a tension wrench in the lock while, with the other hand, inserting a rake. They 
continue to apply tension and to rake until they get that building anticipation 


and finally that climax-like release. 


This next part is important: Once students open their padlocks I tell them to 
immediately reproduce the same result. “Great! Lock that padlock shut and do 
it again! Go!” Once they do it a few times, I tell them to try with reversed 


hands. 


Fun Fact: It’s not unusual for my students to come up to me and say 
something like, “I love trying and trying and trying until the lock finally pops 
open. It’s like...sex!” And why not? You have a secret space you're trying to 
enter and a special “code” lies within that space. Your job is not to violently 
destroy something but to keep it intact. You insert your tools (foreplay, not 
rape) and work very diligently and very specifically, and you try and try and 
try, not knowing how long it will take...until that space opens up to you ina 
final release. (Side note: I’ve always wanted to try my hand at writing erotic 
novels. | wonder if the market is wide open to the “seductive entry specialist” 
genre. Ha! No, that sounds dumb. No. Nope. Okay, well, maybe...) 


I often find that some students work their tension wrenches with their thumbs 
or with their middle, ring, and pinky fingers, or other methods. If they can’t 
open their first padlock, and only if they can’t, I have them stick to the 
formula. Once they crack that code, I highly encourage exploration and 


creativity. 


While I teach people to start with a method (specific hands and fingers doing 
specific jobs), field application will absolutely require you to switch things up, 


and I encourage that on day one. 


Now let’s look at how to position the lock to make it easier to position your 


hands. Although it’s kind of hard to do with doorknobs, padlocks can 


sometimes be rotated to different angles. If the padlock you're picking can be 
rotated, I highly suggest you avoid facing the keyway downward, toward the 
floor or the ground. Also, if you can, try to keep the pins within the lock 
toward the top of the lock. You want to help gravity from working against you. 


When youre picking a padlock with the keyway facing anywhere but upward 


(see top photo, above), chances are that before, during, or after you open the 
lock, your pick or other tools will fall to the floor or the ground. To help avoid 
this, consider repositioning padlocks when you can so the keyway, along with 


your tools, is facing upward (bottom photo). 


You also can prevent your tools from falling by being slow, being smooth, and 


most of all being deliberate and intentional in your actions. And once you 


unlock an obstacle, take a moment to think about which tool you'll remove 
from the keyway first, where and how you can quickly store the tool, and 
whether you need a tool to remain in the keyway for the lock to stay open. 


GRAVITY 


If you have only one pick or tension wrench in your set and it fell two to three feet to the right during an entry 


attempt in the location shown here, the amount of time youd have to dedicate to your entry attempt would 


lengthen significantly. Time wasted searching for tools. 


In “Positioning,” we discussed the danger of tools falling when the keyway 
faces downward. Surprise, tools will fall no matter what. And sometimes tools 
that are under tension will spring out of place and end up several feet away. 
You should still be taking steps if you can to make sure it’s not easier for your 


tools to fall. If you’re new to lock picking, I promise you that you'll drop your 


tools at some point. If you're experienced in lock picking, I'd be surprised if it’s 


never happened to you. 


It’s even more common to have tools springing out of place with restraints. I 
often teach students to use gravity to their advantage when using a string or 
cord to attempt a friction-saw escape from flex-cuffs. Especially with behind- 
the-back escapes, many students try in vain to push a flexible rope or cord up 
through a gap in their flex-cuffs. Whenever you can, rotate your hands or 
arms. If you have to get down on your knees or roll around on the ground, try 
to be in a position where youre holding the string or cord above the flex-cuff 


and guiding the string or cord down through the flex-cuff assisted by gravity. 


In the case study “Pool Fence Redemption,” although the stakes weren't very 
high at the time, I had to reach through a gate to pick a lock I couldn’ see, at 
night, and the keyway was facing the ground. Dropping a tension wrench or 
pick tool on the far side of the gate into the bushes would’ve really slowed me 
down if some variables were different, like not having a partner on the other 


side. 


LIGHTING 


You don’t need to be a tactical genius to understand the benefits of good 


lighting in the field. 


That said, a small headlamp is a must in your Second-Line Gear. A red-light 


option is nice but not always necessary. 
And dont forget the flashlight feature on your phone. 


Smartphones often have other features or devices to help enhance your view. 


Most have both a front and a rear camera you can use to take photos of the far 
side of a fence or gate where there’s a locked obstacle. When trying an under- 
door-tool attack, sliding a phone under the door with the phone’s camera on 
Selfie Mode can help you view the handle on the far side of a door. The 
phone’s video-calling feature can be used to share what’s happening in real time 
on scene, for example, when a partner looking through a window or fence has 


a unique view of the far side of your locked obstacle to show you. 


When it’s reasonable to do so, and with permission, you should also use your 


smartphone to document your entry so you can learn from it and teach others. 


CONCLUSION 


The field is not your couch. Creativity is a plus. Use everything you can 
(morally) to your advantage. Be aware that there are limitations in the 
classroom; still, try to make the most of your classroom setting. Understand 


that in the field the only thing rewarded is results. 


CHAPTER 22 
GUIDELINE: FAILURES 


GET COMFORTABLE WITH THEM, 
THEY ARE A G/FT 


Let’s talk about something that is rarely discussed, though this skill set is 
founded on it: Failure. Because this book was written in the age of social 
media, we'll first take a look at how people access a lot of their “how-to” 


information. 


One of the running jokes in social media, especially when it comes to people 
showcasing their skill sets, is that with the power of editing you can make 
yourself look fast, fluid, and flawless as fuck. Viewers may even compliment 
you with, “Nice editing” instead of “Nice work.” Just speed everything up, 
jigger the lighting, shoot at a cool angle, do a ton of reshoots, and edit the fuck 


out of the footage, and bam, you're an instant professional. 


Some of the more down-to-earth social media influencers take quite a big bite 
out of this phenomenon, and they aren’ afraid to show a clip here and there of 
failing. Some of the very best, IMHO, take this a step further and publicly 


diagnose their failures, helping others learn from them. 


How do we, as Tactical Lock Pickers, utilize failures? The first step is to begin 
every entry with the knowledge that some or even all of our techniques might 
fail. This has several benefits. First, if the only option I have is to pick open a 


medium-security keyway and I know I might not succeed, I'll consider calling 


a locksmith or a friend for a breaching tool while ’'m busy trying to pick. Here 


the possibility of failure triggered my use of additional resources. 


Starting with the option for failure also helps us by getting us to think, “How 
long on average should each of these different methods take? Let’s start with 
the fastest one and go from there.” That way you don’t start with a technique 
that takes forever only to fail and then move on to a faster technique. Try the 


quick stuff first so you can switch sooner to other vectors and methods. 


(1) Comb tool forever stuck inside a locks keyway. I can now teach students to watch out for this. (2) Failure to 
check for a hidden spare key. I now store multiple spare keys. (3) Assumption that a technique for one lock 
would work for another. I now know how to decode the lock with and without tools. (4) Sometimes a barrette 


is too thick to get through a Master 175 lock for a bypass technique. I now carry smaller, thinner shim tools as 
well as a barrette. 


If you don’t believe in failure or if you're not prepared to fail, or you're 
overconfident, you may approach a lock with a pick set and a bad plan. Maybe 
your plan is to use one tool and one technique at the expense of any other and 
not even imagine a next step. This can cause you to spend way too much time 
trying to get your plan to work, and once you finally quit it, benefitting from 


additional resources will take much longer. 


Some of the most effective tools in my Three Lines of Gear were added only 
after a failure or two. Ifa tool works on scene and you put it back in your bag 
and carry on, you havent really learned much. You havent activated any stimuli 


for a change in behavior. 


TOOL FAILURES 


There’s a lot of overlap in this book (by design), so let’s briefly cover tool 


failures from a different angle. 


First off, be aware that manufacturers will often maximize their claims. Or they 
will try to separate you from your money in exchange for a tool that has a 
terrible ROI and a lousy track record. Sometimes a tool is marketed to 
consumers without the disclaimer that it will become less and less effective as 


more and more new makes/models of locks are produced. 


Sometimes a manufacturer will either minimize or entirely fail to mention 
which locks their tool wont open. Most low- and medium-security locks, and 
even some “high-security” ones, are not very expensive to order online. If 
youre planning to continue to practice this skill set and you start buying new 
tools, youll want to purchase a lock (or locks) to test out the tools. How is this 
an example of failure shaping your training? Testing out tools allows you to 


diagnose problems during your training and avoid false confidence in the field. 


Here is an example of practicing at home with a new tool on obstacles before 
utilizing the tool in the field, using one of my favorite tools ever. If you're 
reading this book in order (you don't have to), you've read about the under- 
door tool and why I love it. When used correctly, on the right door, it’s the 


coolest fucking tool I own and I have a blast seeing people’s reactions to it. 


My home, where I practice, is an ever-changing environment with different 
locks and knobs and handles from week to week. I love this skill set and I 


definitely bring it home with me. Ha! 


The nearest hardware store from my home sells several low- and medium-cost 


door handles I can install in fewer than five minutes. I’ve actually bought three 
different door handles. One was a push-button-lock handle (a.k.a. privacy 
handle) that was a great starter in getting the UDT to work for the first time. 
The second setup I bought was higher-security, having a keyway on the 
“outside” handle and a push button on the “inside” handle; the “inside” handle 
had a little bit trickier of a shape, making it harder for the UDT to grab on. 
(I'm sure youre thinking by now, or at least you should be, “We can slip the 
latch or we can pick the keyway or we can use an emergency key or we can use 


a UDT; which should we try first?” Bravo! You're catching on!) 


The third handle I bought had a twist-to-lock feature. These are much less 
common in the real world, especially in government and commercial settings 
because of the Americans with Disabilities Act, which requires certain types of 
easy-access fixtures in buildings. Many twist-to-lock handles cannot be 
bypassed with a UDT because they don’t usually unlock with a turn of the 
handle. The handle is “dead” and doesn’t turn or move at all until you untwist 


the locking mechanism. 


So with three inexpensive door handles, I’ve significantly increased my training 
abilities at home and in the courses I teach. If the location where I’m teaching 
lacks doors that can be attacked with a UDT, I switch out “live” and “dead” 
handles that I bring with me so that students can determine when UDT 
attacks will work and when they will fail, and they will experience the learning 


stimuli of both. 


KNOWING YOUR TOOLS AND SKILL LEVEL 


(1) Practice lock: Breathe heavily on it and it will open. (2) Master No. 3: The lock I start every student out 


with; it can be opened in fewer than five minutes following a 60-second crash course. (3) American 1100 series: 
This represents upgraded security; opening it requires weeks to months of practice and an understanding of how 
pin tumblers work, along with a practiced feel for delicate tension. (4) Schlage Primus: This represents medium 
to high security; opening it requires a precisely shaped tool, a practiced hand, knowledge of whats happening 
inside the lock, and very good understanding of tension. 


Some keyways are very difficult to pick. They require very specific tools to fit 
into the keyway and a very sensitive, steady, and practiced hand to get them to 
open. It’s okay to not have high-security tools and not be able to pick high- 
security keyways. This artform, Tactical Lock Picking, is a percentage game. 


Through your practice you will discover that even some very high-security 
facilities with very high-security keyways have huge, gaping holes you can 

exploit, like a keypad with a code of 1-2-3-4 or a great setup for an under- 
door-tool attack. Knowing your picking skill level will help you assess your 


target. 


KNOWING WHAT NVOTTO PICK 


Knowing which holes to not shove things into is an important life skill. 
Similarly, in lock picking, it’s important to know where we shouldn't shove our 


tools. 


Through our failures we are able to determine the limits to our skills. Some 


clues: 


¢ You often can tell on sight, with very limited experience, which 
keyways are way too tough for you to pick. One of the quickest 
indicators is that a keyway is too narrow or too “zig-zaggy” for you to 
even insert your tools. If you can’ get your tools in, or if once they’re 
in you can't move them around, the keyway is probably above your 
skill level. 
¢ The “official” term for a “zig-zaggy” keyway is paracentric 
keyway. In a paracentric keyway, some of the wards, or 
obstructions, extend past the centerline. Most inexpensive 
locks will allow your rake tool to move from the bottom of 
the keyway all the way up to the pins with little or no 
hindrance. A paracentric keyway requires very thin and 
sometimes very shallow lock-picks and often special tension 


wrenches. 


With minimal practice you will start to learn which lock has which 


type of locking mechanism. And with a quick internet search you can 
probably find out which tools and which techniques will and will not 


work on the lock. This will save you a lot of embarrassment in the 


field. 


¢ Some locks have weathering holes or combo-change holes that look 
like keyways but are not (a great example is the Master 175). Please 
dont stick your tools into something that is not a keyway. 


e Remember, the older a car, the more likely you can successfully attack 
the keyway with an auto-jiggler. More and more cars are being 
produced with keyways that are not wafer locks and therefore are less 


likely to yield to a jiggler attack. 


¢ Knowing when a latch-slip attack will work and when it won't is a 
huge time and energy saver on scene. Become familiar with deadlatch 


mechanisms, starting on doors within your own home. 


CONCLUSION 


We can all certainly learn much more from our failures than from our 
successes. I’d like to take one final moment in this chapter to say I intentionally 
included several complete as well as partial failures as case studies in this book 
for very good reasons: (1) ’m human and I fuck up; I’m not here to hide that 
or to pretend I’m better than I am. (2) I want my students (and now you) to 
learn from my mistakes and boost your chance of success in the field. (3) I 
want you to follow the thought process that led to the particular organization 


of the curriculum I teach and how I teach it. 


I’ve had way more successes than failures in the field, but I think the value of 
this book would have suffered if all I did was present a few select, flawless 
entries shown with impeccable photo evidence. Thank you, seriously, for 


taking the time to learn from my experience. 


CHAPTER 23 
GUIDELINE: SECURITY 
ASSESSMENTS 


IN KNOWING HOW TO ATTACK, YOU 
LEARN HOW TO DEFEND 


I was around 10 years old when my father came home from work one day after 
some type of officer survival training. This was back in the 1990s. He 
explained the training scenario to me step by step: after hiding a handcuff key 
on his person, he was searched, handcuffed behind his back, put into a dark 


prison cell, and expected to escape his restraints. 


Being a child, I was confused: “Why would Dad [a police officer] have to learn 
how to break out of handcuffs? Doesn’t that make him a criminal?” So I asked. 
The answer stuck with me and has been reinforced over and over: “If we 
know what to do to escape from handcuffs, then we know what 
to look for to prevent an escape.” Thinking back on that now, I can 


almost fee/ the wires in my brain rerouting themselves. 


If you want to score points on offense, you should understand defense. If you 
want to keep people handcuffed, you should understand what they would need 
in order to free themselves. If you want to stop people from breaking into your 
home or business, you should understand how they might easily achieve entry. 


If you are forced into protecting your property in a war, you should 


understand how invading forces operate (that escalated quickly). Understand 


the flip side. 


I teach students how to navigate their way through all sorts of locked obstacles 
and restraints, and in learning this, they gain another huge ROI: a more 


informed and focused approach to testing and upgrading their own security. 


Here’s a lightning round of general points about security before we talk 


specifics: 
e There is no such thing as total security. 


¢ Security is like an onion: It has layers. Security should take a layered 


approach. 
¢ Security exists and is often designed to buy you time. 
¢ Security is always a balancing act between effectiveness and efficiency. 


¢ Security shouldn't be so all-encompassing that it puts a halt to every 
other aspect of your mission or your goal. It should allow you to still 


live your life. 


¢ A large part of security is having a security mindset. Your security 


cannot exist for long if you don’t take any part in understanding it. 


¢ Security requires ongoing maintenance and assessment. 


PREVENTING PEOPLE FROM PICKING YOUR LOCK 


For pin tumbler locks (arguably the most common type of lock in the US), 
one of the easiest and least-expensive ways you can upgrade 
security is to change out the standard pins inside for security 
pins. After you purchase a few inexpensive security pins, you can probably do 
the repinning with the tools you already have in your home and a little online 
research. But beware! You can seriously fuck this up, and tiny pins and springs 


can fly everywhere. 


You could have a locksmith do the repinning for you and it wouldn't break the 
bank. If you want to learn how to do it yourself, try it the first few times on an 
inexpensive padlock. Not all padlocks, however, can have their cores removed. 
A simple internet search will point you toward locks whose cores are 

removable. Maybe start with the American 1100 or 700 series. Also search the 


internet for a training video that includes the term repinning. 


There are locksmiths out there (and hobbyists and Locksport enthusiasts) who 
can pick high-security pin tumbler locks and other locking mechanisms. Many 
people who've had just a few days’ worth of lock-picking practice could 
probably make a successful entry on roughly 50 percent of the front doors in 
this country. There’s no such thing as total security. Tactical Lock Picking is a 
game of percentages. If you want to keep neighborhood kids from sticking 
paperclips into your front-door lock and having it pop right open, you can 


easily knock that percentage of perpetrators out of the game. 


You can change the lock to something other than a pin tumbler (ot a wafer 
lock or a warded lock, which are often less secure than a pin tumbler). Most 


people who learn lock picking start with pin tumbler locks. Opening a lock 


other than a pin tumbler will most likely require specialized tools and some 


experience with the particular mechanisms inside the lock. 


You also can adopt a protocol for your home or business that a lot of 
organizations use: Changing the entry codes and keys after a break-in or theft, 
the firing of an employee, or the retiring of several employees. If you are 


moving into a new house or apartment, you should definitely be changing all 


the keys around your home. 
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(Top to bottom) Standard pins, the easiest to pick; serrated security pins offering slight resistance; miscellaneous 
security pins, which are much more difficult to pick. 


A great step in how to choose the right lock for you is to search the internet, 


especially video hosting platforms, with videos that are not from the 


manufacturer but from hackers, lock pickers, and security assessment 
personnel. If the tippy-top experts from the internet’s hacking communities 
struggle with picking open a lock then you can bet that lock will keep out a 


very good majority of even trained lock pickers. 


Instead of using a standard residential lock (top), you could use a commercial lock with more pins and 
with a paracentric keyway (bottom). It would certainly take much more skill, effort, and specialized tools and 


knowledge to pick open. 


PREVENTING PEOPLE FROM KICKING IN YOUR 
DOOR 


Much more common than having your locks picked open is 
having your door kicked in or a window broken. Often, people who 
learn how easy lock picking is complain, “Oh my God, I have to change my 
locks.” But because forced entry is more likely, this is almost like putting your 
hands over your private parts to protect your junk when someone is gearing up 


to punch you in the head. The defense doesn’t always match the offense. 


Pro Tip: Before you implement a new security measure, you must identify 
what specifically you intend that security measure to prevent. 


There are a few easy and inexpensive things you can do to upgrade a perimeter 


door on your home or business in order to prevent it from being kicked in. 


(Left) Standard, low-security hardware on a residential door frame. (Right) 


Simply getting rid of the 1-inch or ¥2-inch screws that hold your latch strike 
plate in place and installing 3-inch screws that penetrate into the studs behind 


your doorframe will make it much more difficult to kick in a door. 


There are also upgrades above that level. Latch strike plates that extend the full 
length of your doorframe are much more difficult to kick in and metal plating 
will protect your doorknobs and deadbolts. This upgrade is more expensive 
than just changing out screws (see photo, above) but will not terribly break the 
bank. A one-time purchase installed correctly could possibly save you from 
being robbed of hundreds or thousands of dollars or could save your life and 


the lives of your loved ones. And it fits within my security principle: “Effective 


security should not drastically change the way you live your life day-to-day.” 


Along with being inexpensive, it’s “Set it and forget it.” 


a Be : a 
Reinforcing hardware on an interior residential basement door to prevent forced entry. Slightly costly but once 


installed it doesn't change the way you live your life. This is exactly the type of security upgrade I promote. 


If your front door has a window or a window next to it, change that if you can. 
You might not need to implement all these suggested security measures but 
this one should be at the top of your list. It takes less effort to smash a brick 
through a window and reach inside to unlock a door than to put the effort into 


kicking in a door. 


Simply locking your windows will prevent a large percentage of criminals from 


sneaking into your home. It was clear from the burglaries I worked during my 


brief law enforcement career that windows were a favorite of criminals. They'd 
enter a home either by breaking a window or, much more commonly, by just 


plain old opening a window left unlocked. 


If you have windows you really like and you want to keep them but you also 
want to give yourself a little extra security, consider window film. It’s available 
in different grades and cost points, some of which provide shatter proofing. ’m 
a big fan of security measures that don’t break the bank and that don’t change 
the way you have to live your life. Window film is one of the more reasonably 
priced burglary safeguards and doesn’t disrupt your day-to-day security 


operations. 


PREVENTING SHIMMING FROM BOTH SIDES 


Two examples of doors that Ive opened, one from the pull side (above) and one from the push side (below), 
with items kept in my wallet, my First-Line Gear. 


Most doors with a simple latch (and sometimes even ones with security 
latches) allow for a latch attack from either side of the door. If you know the 
easiest type of obstacle to attack, you'll have a good foundation for security 


upgrades you might want to implement. 


One upgrade is to go from a simple latch to a latch with a deadlatch 


mechanism. But make sure it’s installed correctly. 


Just plain fucking install a proper tight-fitting door with a proper well-placed 
latch. If you can’t insert a tool into a door jamb because of the tight fit, the 
type of latch used is slightly less important. (There are still ways to access those 
latches with your tools in a tight fit with things like door wedges.) This will at 


least knock out some percentage of attempted entries from people that don't 


belong. 


(Left) A simple latch. (Right) A latch with a deadlatch mechanism. 


(Left) A door jamb that is very tight, making it very difficult to insert entry tools. (Right) A high-security 


commercial door latch with an oversized latch strike plate (improper fit) and a very wide gap in the door jamb 
(improper fit), allowing a successful attack with a coat hanger. 


As we talked about previously in this book, sometimes shitty apartments have 
really tight door fits so tools can’t find their way in, and sometimes high- 
security government facilities have doors with terrible fits and doorframes with 
wide-open latch strike areas. I’ve gotten through hundreds of government 


doors with a coat hanger and plenty of room to spare. 


PREVENTING UNDER-DOOR ATTACKS 


This type of attack is not as common on perimeter doors of facilities because of 
the threshold on the floor, sometimes called the weather plate. The weather 
plate has a raised edge that is supposed to prevent, for example, water buildup 
from leaking into a doorway. It also happens to make it more difficult to use an 


under-door tool when weather plating is present. 


It would be unreasonable to install a commercial weather plate on every 
doorway in a residential home or apartment. It also would be unreasonable to 
do so on every doorway within a business or commercial building. Be sure to 


keep regulations and compliance codes in mind (especially the Americans with 


Disabilities Act). 


Let’s start with how an under-door attack does work. 


A commercial double door with a huge gap underneath, visible from far away. 


For the easiest, most successful UDT entry scenario there must be space under 
a door. Also, the door should be all glass or partly glass, allowing you to 
visually track your tool. No robes or towels should be hanging on the back of 
the door. And the handle must be an alive handle. Rule of thumb: Most door 
handles with a push-button lock are double-action; most door handles with a 


twist lock on the privacy side are single-action. (There are exceptions.) 


A UDT attack on this door handle is made easier by the window in the door, allowing you to visually track 
your tool on the far side of the door. 


To upgrade your security: 


e If you can, try to make the space under the door nonexistent or at 


least smaller. 


¢ If you're able, remove any windows from doors that have handles and 
wide floor gaps. Or at least choose a smaller window and place it 


where you can't see the door handle through it. 


If policy/regulation allows, consider knobs instead of handles. 


¢ Some simple plastic barriers installed with simple screws or sticky pads 


can severely hamper UDT attacks. 


PREVENTING DEADBOLT WALKING 


(1) A pocketknife digs into a deadbolt, close to the doorframe. (2) The knife slides toward the door, where the 
latch would recede to the unlocked position. (3) The knife digs into the deadbolt. (4) The knife “walks” the 
deadbolt in toward the door (and the unlocked position). 


Deadbolts are supposed to slide out of the door, into the doorframe, and act 
“dead,” or unmoving. The mechanism that makes the bolt “dead” is activated 
only if the bolt is fully extended into the doorframe. An improperly installed 
deadbolt happens when the deadbolt hole in the doorframe is not drilled 
deeply enough to allow the deadbolt to extend fully into the frame so it 


engages the “dead” mechanism. 


You can take advantage of improperly installed deadbolts by digging your 
pocketknife into the far end of the deadbolt and wiggling the bolt toward the 
unlocked position a little at a time: A little wiggle, waggle, walk. Use this 
deadbolt attack only if you're on the pull side of the door (the side of the door 


with a gap between the door and the doorframe where you can see the 


deadbolt). 


A properly installed deadbolt ensures the bolt extends fully into the doorframe 
and activates the “dead” mechanism. ‘There are also deadbolts that have barbs, 
or protrusions, that stick out of the side of the deadbolt once the deadbolt is in 
the locked position, an extra step in preventing the removal of the deadbolt 


from the frame. 


As with our shim-attack prevention, a door whose fit is so tight that you can’t 


get a tool into the door jamb will defeat this technique. 


The tighter the better. Pattern confirmed. 


Experiment: Try this at home. Open the front door to your home about 
halfway. Manually use the thumb-turn for your deadbolt to extend the 
deadbolt fully. Use your hand to try to push the deadbolt back into the door, 
to the unlocked position. You probably can’t. Now use the thumb-turn only 
enough to extend the deadbolt about halfway to the locked position. Using 
your hand, try to push the deadbolt back into the door. You should be able to 
recede the deadbolt into the unlocked position this way, with just the push of 
your hand (or walked with the edge of a knife.) 


PREVENTING FOUR-DIGIT-CODE ATTACKS 


Let’s start with this: Don’t use 1-2-3-4! 


Besides that...stay away from common access codes, and stay away from codes 


that mean something to the owner of the lock (socially engineered codes). 


For the first digit in your four-digit code, please don’t choose 0, 1, or 2. There 
are at least two reasons for this: (1) With a brute-force attack (applying the 
Plus-One Method), those numbers are smaller and therefore will be chosen 
first. (2) People who are looking for socially engineered codes will likely begin 
with four-digit years, particularly 1-9-x-x and 2-0-x-x. 


Stick to numbers that are truly random, meaning they don’ fit into the other 


categories discussed in the chapter “Guideline: Four-Digit Codes.” 


When the numbers on a keypad are rubbed off, you have at least two options: 
change the fucking code or buy a new keypad. 


There are other times when it’s a good idea to change codes, including when 
someone is fired under less than pleasant circumstances or when large groups 
of people within an organization retire at the same time. If one of these applies 
—this is important—you need to change the codes frequently enough that it 
fucking makes a difference but not too frequently that people can’t remember 


it...causing: 
¢ People to write the code somewhere nearby. 
¢ People to send out a group text with the new code. 


¢ People to become accustomed to coworkers standing at a facility's 


front door, locked out, and shouting across the parking lot, “Hey! Did 
they change the code again? What is it now?” and someone 
responding by shouting the answer. (Ask me how I know this is a 


thing...) 


A passion of mine, being clued in on the behavior of bureaucracy, includes the 
fundamental understanding that every policy, protocol, and order issued in a 


bureaucracy has unintended consequences. 


Another option, as stated in our “lightning round” of general points about 
upgrading your security (Are you sick of the overlap yet?) is to layer your 
security. Maybe place cameras above your keypads. Big, bold cameras pointed 
right at the keypad user. To be honest, they'll be almost as effective even if 


they’re fake and even if nobody is monitoring what they show. 


PREVENTING BOLT-CUTTING ATTACKS 


Okay, this one’s gonna be fun for me. This is by far my favorite anti-lock- 


picking statement to counter: “I don’t need to learn how to lock pick, I have 


bolt cutters!” 


Show me on this puck-shaped lock (see photo 1) where you would put the bolt 


cutters. Go ahead. I’m waiting. I’ve got plenty of time... 


Even a shitty $10 padlock properly located inside an inexpensive exterior 


casing of metal (photo 2) can keep out the biggest of bolt cutters. Shielding 


not only prevents padlocks from being cut but also makes them much more 


difficult to pick open. 


Imagine you're locked out of this front door (photo 3). (Come on, friends, you 
know what’s coming next, don’t you?) Okay...show me on the door where 


youre gonna put your bolt cutters. 


People don't normally walk around carrying big-ass bolt cutters (photo 4) in 
their hands or pockets or on their belts. A friend of mine once boasted he 
didn’t need to learn lock picking because he had bolt cutters, and when | 
confronted him with, “Do you have bolt cutters on you right now?” he 
countered, “Well, yes. I always have them on me. And if I don’t, I’m always 


able to get some.” Whoa! Jesus, guy. 


“When you travel for a vacation, do you fly with them or do you buy them as 


soon as you land?” I asked. 


This guy must have been half brain-dead or fucking with me because he 
answered, “I don’t fly. I drive my pickup everywhere, and I keep a pair in 
there.” Okay, good luck living 100 percent of your life within arm’s reach of a 


pair of industrial-size bolt cutters. Now on to our next point... 


Three different sizes of chains. Not all bolt cutters are created equal, and not all chains or padlocks are created 


equal either. 


At a school I attended that taught breaching techniques to first responders, 
members of the staff (a SWAT team) told a story about when they were sent to 
an entry where a padlock was hanging off the front gate of a facility. The plan 
was to use bolt cutters to quickly break open the padlock and then storm in to 
save the day and arrest whomever for whatever. Long story short: They used 
what was described as “these huge fucking bolt cutters” on the padlock and the 
teeth of the bolt cutters, the “blades,” opened up only a tiny fraction of an 
inch, while the padlock was a big-ass padlock— too big, if only slightly. The 
point here is that even if you have bolt cutters, not all bolt cutters are created 


equal. 


Padlocks can come with their own shielding. 


So purchasing padlocks with thick shackles is a good first step in your security. 
Shielding your padlocks (making it more difficult for bolt cutters to reach the 
padlock shackle) is another great step. There are also different grades, or 
thicknesses, of chain. This is very important: If what you are guarding is 
valuable enough to you, spend the extra money and go thick. (Buy once, cry 


once.) 


And again, layering. Set up a visible camera, even a “fake” one, nearby. Shine 
some bright-ass lights in the area. Be creative. Take five minutes and imagine, 
“If I were a criminal, how could I use bolt cutters to defeat this chained 


obstacle?” 


PROTECTING VEHICLES 


Criminals do risk assessments too. (For the rest of us most of our risk 
assessments include the bottom line: Jail = no go.) Let me give you an example 


of a risk assessment for breaking into vehicles, from a criminal’s point of view. 


Criminal: “There’s a roll of bills in the cupholder of this car. I'll take a look 
around for cameras or other people. Nope, none. Okay, noted. The car next to 
it has a few wrapped Christmas presents on the back seat. How about the car 
next to that one? Hmm...looks clean and empty. There’s not even trash on the 
floors. Probably a rental. Okay, let’s break into the first two cars and steal the 
money and the presents and then GTFO!” 


I haven't begun my foray into fiction writing yet, but hopefully you are 
catching what I’m tossing out to you. It’s widely known in law enforcement 
that if criminals see nothing worth stealing in a vehicle or a house, they have 
very little incentive to do an exploratory “sneak and peek” or, even less, a 
“break-in and peek.” So if you keep valuables out of sight, you are stopping a 


problem before it starts. 


Parking in a well-lit area and installing cameras in your front driveway and an 
audible alarm system and tinted windows in your vehicle are some options for 


steering people away from breaking into the vehicle. 


Unfortunately, there aren't a ton of other things you can do to fortify your 
vehicle against burglaries. The biggest reason is that most vehicles are mobile 
“fishbowls.” Criminals will continue to break glass. Do your best, where you 
can, to create an environment where a criminal’s risk assessment returns a less 


than positive result. 


TARGET HARDENING AND SOFTENING 


This topic alone could be a whole book. Every potential target requires the 
modification of its own particular environment for security purposes. Let’s take 
a look at some ways to make your home appear difficult to access or, 


alternatively, appear to present no reason to break in at all. 


Examples of target hardening include shining a bright light on your entry 
points and clearing away shrubbery where criminals could hide, installing 
visible cameras, putting up fencing, and posting warning signs. Gravel 
driveways and gravel under the exterior of your home’s windows will make 
criminals audibly aware of every step they take and on quiet nights might alert 
you when youre home. In my few years in law enforcement, I never saw a 
burglary of a home guarded by a large dog, save one exception in which the 
criminal was a family member and the dog was familiar with him. One of the 
best advancements in home security in the past few years is a doorbell camera; 
it’s well worth purchasing. For more ideas, start getting creative and tapping 


into that sexy, mischievous brain of yours. 


Target softening involves making it look as if your home is not worth breaking 
into. Especially after the holidays, don’t put your flat screen TV or computer 
packaging out on the curb. Set the packaging in a corner somewhere inside 
your home for a while and break it down (this can be fun) so it fits into a 
trashcan or trash bag when throwing it out. Install rea/ curtains on as many 
windows as you can (curtains that truly prevent peeking in from the outside); 
if a criminal can’t peep into a window to see expensive shit, he'll most likely 
move on to a house with a guaranteed payoff. The easiest, quickest, and 


cheapest way to test your windows is to look into them from the outside when 


it’s dark out. Seriously. This could actually be an exciting activity with your 


loved ones, just don’t make it creepy. 


LETTING SOMEONE IN 


Something I do in my home and I highly recommend you do with your family, 
including your children, is to practice “door protocol.” This is nothing new. 
When I was a kid in the 1990s my parents told me, “Don’t open the door for 
strangers,” and they would occasionally remind me, “If someone asks if your 
mom and dad are home, just tell them that your mom is in the shower and 


your dad doesn’t want to be bothered and that they should come back later.” 


From my professional experience, I can attest to the fact that it’s less common 
for criminals to pick locks (when it comes to residential homes, anyway) than 
for people to open the front door wide open for criminals. Two robbers will 
drive up to a residential property and one will stay in the car out of sight while 
the other walks to the front door. Once at the door, robber 1 will talk to the 
homeowner about landscaping or security systems or whatever and will ask if 
any other residents are home. Robber 1 will persuade the homeowner and any 
current residents to go with them into the backyard to offer a quote or do an 
inspection...while robber 2 waltzes right in the front door, goes straight to all 
the high-value target areas in the home, and scrambles back outside into the 
van. Robber 1 then will bring the resident(s) back into the home and shake 
hands and say, “I'll be in touch.” They won’. 


Door protocol thoughts: 


¢ There’s vo reason a company shouldn't give you fair warning before 
they show up at your home for any type of commercial work. They 
should have your mailing address, phone number, backup number, 
and email. If someone shows up unannounced, that is already a red 


flag. 


¢ There’s also no reason for door-to-door sales pitches. Even at the 
poverty level in this country, people have access to some of the most 
powerful communication tools that have ever graced this earth. Sales 


pitch equals red flag as well. 


¢ If children, and sometimes women, are alone in a residence, they 
should consider dissembling and saying other members of the 
household are...pick something: Sick. Sleeping. Cleaning guns. 
Practice being a good liar. Have a response prepared so it’s easier to 
recall at the moment. 
¢ If you tell a salesperson, “You cannot come in because my 
husband is sick in bed right now and he’s contagious,” and the 
salesperson insists on entering, that should be an even bigger 
red flag. Tell them to wait, close the door, lock it, and call 


your local police or a neighbor or someone. 
¢ Consider not even opening the door and instead talking through it. 


e Add a doorbell camera to your front door, allowing you to view 
whoever’s at the door and speak with them without having to open the 
door. This is one of my favorite new security technologies. There are 
tons of videos online showing people with bad intent walking up to 
the front door of a home, seeing the camera, freezing in their tracks, 
and walking away. This technology has stopped many problems before 
they’ve started. As a bonus, even if problems start, it provides evidence 


of a crime for prosecution. 


STAYING IN AND KEEPING OUT 


One of the things people worry about when they travel is someone breaking 
into their hotel room while they are asleep. Those of you out there who are 
married, have you ever had the discussion about who sleeps on the side of the 


bed closest to the hotel room door? And why? Ha! Because what if someone 


breaks in through the door? 
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Iam a huge fan of low-tech solutions. They're often inexpensive and easy to 
use. Let’s look at the travel-friendly examples shown in the photo, above: (1) 
The odd-shaped red wedge is a generic tool I got on the internet and I love it. I 


always bring it with me when I travel. I’m able to put a lot of shoulder into a 


door, and this little guy, when properly installed, keeps a very secure hold on 
the door. However, it only works if you're on the pull side of the door and it’s 
the (outside) push side that’s locked. (2) The grey wedge, a $2 rubber 
doorstopper, is better than nothing. It can be bought inexpensively wherever 
you travel. Door stoppers like this are available in rubber, wood, or other 
materials. (3) The pressure-pad on this wedge is equipped with a very loud 
siren; once the door strikes the pressure plate, the siren goes off. I really like 
that the wedge not only offers physical resistance to the door being pushed 
open but also lets the criminal know the occupants and possibly others have 
been alerted to the break-in. (4) The yellow rubber stretchy thing is a 
DoorJamm. This very low-tech tool offers ways to creatively keep doors 
unlocked in case you gain entry through a locked obstacle in an emergency and 
want to prevent it from locking behind you and deterring family, friends, 


backup, or first responders. 


A DoorJamm applied to the front door of a recent commercial training site for my Tactical Lock Picking course. 
This device would make several of my top-10 lists: Low Cost, High Value. Easy Storage. Most Creative 
Solution. Most Multifunctional. (Available at doorjamm.com.) 


As you may have noticed, I try to get people to think about their environment. 
This is especially relevant for travelers. Keep your eyes open for what you can 
use from your environment, and if you can, do some budget-conscious 


shopping at the local hardware store next time you travel. 


CONCLUSION 


Your security upgrades should be for a reason. You should be able to say that 
reason out loud and hear if it makes sense. “I want a locksmith to change 
the keys to my home to prevent my door from getting kicked in” is not a 
sound investment. The solution does not match the problem. Conversely, “I 
want security film on my windows to help prevent someone from throwing a 


brick through them” is a smart move. It makes sense. 


Use that wonderful internet of ours to do some research before you make an 
investment. Search online for a security system you have in mind, and if in the 
first 30 seconds of watching a posted video you discover a child has found a 
flaw in the system, maybe you don’t invest in it. Maybe. Every security system 
has flaws and you should make an effort to know what those flaws are, but 
even a flawed system can provide a lot of value by defeating a certain 
percentage of criminals. Just be aware what the system is intended to be used 


for and what it’s not. 


Owning guns and never having spent a single eight-hour day training does not 
make you a gunfighter. Moving into a new home, never doing a security 
assessment walkaround, and lying in bed thinking, “I hope nobody breaks in” 


does not make you burglary-proof. 


I hope that reading about the many ways I’ve made emergency entries in the 
field has had a two-fold ROI for you: knowing how to work through locked 
obstacles and also how to take a better, more focused approach to upgrading 


your own security. 


CHAPTER 24 
FINAL DEBRIEF 


We talked about what Tactical Lock Picking is and what it is not. We talked a 
lot about the economics of carrying tools and, specifically, about dividing tools 
into Three Lines of Gear that work for you and pairing those tools with Attack 
Vectors on locked obstacles. What I recommend is a baseline. You should use 


what makes sense for you and get rid of what doesn’t. 


We provided a mnemonic device, My Sister Always Makes The Noisiest 


Orgasms, for the phases of Target Assessment. We encouraged you to switch 
around the phases when it makes sense for your entries. I am not a second- 
grade schoolteacher demanding that you recite the letters of the alphabet in the 
correct order. I’m here to help cultivate you, the user, and your unique abilities. 
When you get frustrated, remember to remove your tool(s), step away from the 


locked obstacle, take a deep breath, and start to reassess. 


We talked about defeating locks with lock picking, bypasses, and decoding, 
including guessing combo codes based on environmental cues. We talked 
about letting your environment speak to you. Your environment speaks to you 
in many, many ways. In the process, patterns will emerge. Some could be codes 
written on the backs of locks. Others patterns could come in the way of 


failures and partial failures you will certainly experience. 


We talked about door locks, padlocks, combination locks, digital keypad locks, 


and the overlap with and differences between them. 


We talked about escaping illegal restraints. And we talked about understanding 


how to attack a locked obstacle, leading us to discussing how to defend that 
locked obstacle. 


You, the reader, spent a bit of time listening to me rant about doing what is 
morally right. I promise you, if you want to live on the edge, you love drama, 
and relish finding yourself in a lot of trouble, you can do that with this skill 
set, though I very seriously don’t recommend it. I teach a very specific framing 
of the skill set: Using limited resources to get through locked obstacles in 


emergencies when it is morally right to do so. Period. 


I hope you found usable information in this book, and I'd love to teach you 
more in one of the many courses I offer. The most important goal of my 
courses, besides truly preparing students for the field application of this skill 


set, is to provide way more value to my students than the cost of tuition. 


Please share this information with your friends and loved ones. I especially 
encourage you to safely teach your loved ones some restraint-escape options. 
Feel free to use excerpts of this book (with credit) when training others. And if 
you want to contact me, please head over to the website 

Uncensored Tactical.com or find me on social media with the name/handle 
Uncensored Tactical. I fucking love meeting all sorts of weird people and 


helping them make their lives better. 


I am so, so thankful that you took the time to check out the content I’ve 


created here. 


Thank you. 
Pat 


Uncensored Tactical.com 


GLOSSARY 


10-4: Radio lingo for “Affirmative.” 

10-8: Radio lingo for “In service” or “Ready to handle service calls.” 

21: Radio lingo designating a burglary. 

32: Radio lingo designating a suicide or suicide attempt. (Also, Signal 32.) 
51: Radio lingo for “On my way.” (Also, 10-51 or t51.) 

66: Radio lingo for “Cancel.” 

97: Radio lingo for “On scene.” 


alive handle: A handle on the inside of a locked door that, if locked, when 


turned will automatically unlock and open a door. 


anchoring: Getting up close to a locked obstacle and using physical contact 


to eliminate movement in the lock so you can focus on fine motor skills. 


AO: Abbreviation of Avea of Operations, meaning the locality in which you will 


most often be practicing your craft. 


Attack Timeline: The equation as well as the solution to how long it takes 
to get a particular tool into play on a particular Attack Vector, added to 


how long you estimate an entry attempt might take. 


Attack Vector: All the options known to you that you can manipulate on a 


locked obstacle (or where it is housed). 


brute-force attack: An attempt to open a mechanical or digital-code lock 


with every possible combination (usually in order, and counting up). 


bypass: A technique that does not require you to enter a key, pick a locked 
keyway, or input a code on a keypad. Instead, you circumvent the standard 
input of a lock and manipulate something closer to the mechanism that 


keeps the lock...locked. 


daisy chain: The use of two or more padlocks to complete a loop of chain so 
opening either padlock will give you unrestricted access through the locked 


obstacle. 


dead handle: A handle on an “inside” door that, when locked, will not 
move at all if you try to turn it. In order for the handle to turn, it first must 


be manually unlocked. 


deadlatch mechanism: An extra “button” located adjacent to the latch on 
your door that helps keep the latch from being pressed into the side of the 
door. A deadlatch mechanism, when activated, prevents you from slipping 


the door latch to gain entry. 


double-locked handcuffs: Handcuffs that will not freely open or tighten 
because a mechanism inside them has been activated which blocks 


movement of the ratcheting system. 
failures: Stimuli that help us learn even faster than from our successes. 


First-Line Gear: The tools you routinely carry on your body, on your belt or 


keyring, or in your wallet or pockets. 


Halligan bar: A pry bar commonly carried by firefighters. Think of a 


standard crowbar but on steroids and with a fork and a blade at either end. 


jiggling attack: A technique used on wafer locks. You twist your tool (a 
jiggler or an auto-jiggler) inside the keyway creating some turning tension, 
and while maintaining that tension you “jiggle” the tool around inside the 


keyway until the lock opens. 


keyholder: A neighbor, maintenance worker, family member, or friend who’s 


given a backup key to a location. 


Level of Urgency (LOU): The exigency with which you are operating, 
which affects the speed of your efforts. The most urgent level is “Right 
Fucking Now;” the medium level, “The Quicker the Better;” and the least 


urgent level, “Administrative.” 


Line in the Sand: How long you will spend on a specific entry attempt 
before resetting, reassessing, and switching to another tool, another 


technique, or another Attack Vector. 


Moral Right for Entry (MRE): During emergency situations (during any 
situation, really) you should be determining whether what you are doing is 


morally right under the circumstances for all parties involved. 


“Now or Later:” Determining whether to attempt an entry immediately or 


to continue to assess your target for more options. 


openable lock: (1) A pairing of a lock and an entry tool that when used 
correctly by a competent and skilled practitioner will gain them entry. (2) 
An openable lock for you, meaning someone of your skill level and 


knowledge base can pair the lock and an entry tool to gain access. 
Priority 2: Radio lingo for “Driving with lights and sirens on.” 


raking: A lock-picking attack where you randomly shuffle the pins around 


inside a keyway while applying light tension. This is most effective on low- 


security pin tumbler locks. It occasionally works on certain types of wafer 


locks. 


passageway knob/passageway handle: A doorknob or door handle 
that lacks locking features on either side. This type of knob/handle is used 
when both sides of a door are open to traffic and don’t require locking. It’s 


commonly found in hallways or lobbies. 


pin tumbler lock: A lock that operates by a center core (plug) into which a 
key fits, lifting stacks of pins up into a chamber; once the pin stacks have 
reached a particular height, they will separate and allow the plug to spin, 
opening the lock. One of the most common types of locks in the US. 


pull door: When you have to pull a doorknob to open a door once you've 


turned the doorknob and unlocked it, the door is considered a pull door. 


push door: When you have to push a doorknob to open a door once you've 


turned the doorknob and unlocked it, the door is considered a push door. 


Second-Line Gear: ‘The gear you store in a small go-bag. It is highly 
recommended that this bag have some type of shoulder strap(s) so you can 
be mobile while you multitask and don’t have to leave your tools sitting on 


the ground somewhere. 


shielding: A barrier within a locking system (like a security wafer that 
prevents a bypass tool from reaching into the body of an American 1100 
series lock) or forming part of the outer shell of a lock (like some of the 
larger, bulkier Master Lock padlocks shown in the chapter “Guideline: 
Gates”) or provided by the environment (like the box enclosing the padlock 


on the blue fence shown in the case study “Pool Fence Redemption”). 


shimming the latch: Using a tool to push a simple latch into the side of a 
door so the latch no longer extends into the doorframe and prevents the 
door from opening. This can be done from the pull side of a door (when 
you are able to see the latch) by using such tools as a coat hanger, string, 
wire, knife, or specialty tool. It can also be done from the push side of a 
door (even when the latch is not visible) by using a flexible tool like a credit 


card, laminated sheet of paper, or other specialty tools. 


simple latch: A chunk of metal that extends from the side of a door. That’s 
about it. Nothing fancy. (You will likely find one of these in an interior 


door in your home.) 
slipping the latch: See shimming the latch. 


Tactical Lock Picking: The practice of using limited resources in the field 
to defeat locked obstacles during an emergency when it is morally right to 


do so. 


Third-Line Gear: Gear that doesn’t fit in First-Line Gear or Second-Line 
Gear. This consists mainly of tools that are too big, too heavy, or too 
specialized to carry to every entry; tools that are backups or extras; and tools 


that are administrative (like key blanks and key-cutting machines). 


Two-Step Rule: Ifa key or a combination for a locked obstacle is stored 
nearby, it will usually be within two steps of the obstacle, or even an arm’s 


length. While there are exceptions, this is a good start for searches. 


wafer lock: Often less secure than a pin tumbler lock, a wafer lock works on 
a similar principle, but instead of lifting stacks of pins, a key lifts and 


sometimes lifts and lowers thin metal wafers. Wafer locks can be one-sided 


or double-sided. Most cars used to have wafer locks on doors and ignitions 


but lately not, a.k.a. disk tumbler lock. 


walking the deadbolt: Using a tool to manually slide a deadbolt latch into 
the unlocked position in incremental steps. This can be done from the pull 


side of a door. 


warded lock: A lock with several chambers inside the keyway and a simple 
spring or latch housed within one of the chambers. ‘This is very low-security 
(due to the minimal number of moving parts). It’s often found on 


inexpensive padlocks designed for outdoor use. 


